Security advice, made clearer

A security advisory affects the Smart Post plugin for WordPress. Here is what the finding means and the sensible checks for site owners.

A security advisory affects WP Activity Log versions up to and including 5.6.1. Here is what site owners should check, and how to respond carefully.

A security advisory covers the Newsletters plugin in versions up to and including 4.18.1. Here is what the finding means and what site owners can do next.

A published advisory covers the Acadlix LMS plugin up to version 1.1.9. Site owners should identify the installed version and follow the publisher’s current remediation guidance.

A published security advisory concerns All in One SEO versions up to and including 5.0.3. Here is what the issue means and what to do next.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A vulnerability in pypdf versions before 6.21.3 can make an application spend excessive time and memory processing a specially crafted encrypted PDF. Here is what website and application owners should check.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A published security advisory affects pypdf versions before 6.21.3. It concerns how the Python library reads certain PDF page labels, rather than proving that any particular website has been compromised.

A high-severity vulnerability has been reported in Volmarg Personal Management System through version 2.1.0. Here is what site owners and maintainers should check.

A vulnerability in Cotonti through version 1.0.0 could let an attacker predict validation tokens used for account registration and email changes. Here is what that means for site owners.

A NIST vulnerability record says GleezCMS 1.2.0 may allow a remote attacker to obtain sensitive information. A fixed release and severity rating have not been confirmed.

A vulnerability in python-jose can bypass authentication in a specific configuration. Here is what website owners and maintainers should check.

A published security advisory affects PandaWiki releases from 3.65.0 through 3.87.5. Here is what site owners should check, without assuming that an affected version has been compromised.