AdeptLanguage's Adept programming language had a vulnerability in its remoteBuild.yml workflow file that allowed attackers to extract a GitHub token and push malicious code or rewrite release commits. The issue has been patched in commit a1a41b7. Aeropage Sync for Airtable had a vulnerability that allowed authenticated attackers to upload arbitrary files, potentially leading to remote code execution. ALBEDO Telecom's Net.Time - PTP/NTP clock software had an insufficient session expiration vulnerability that could permit attackers to transmit passwords over unencrypted connections.Amazon's IonDotnet had a denial of service vulnerability due to an infinite loop condition when reading binary Ion data. The issue has been patched in version 1.3.1. Aonetheme's Service Finder Bookings plugin for WordPress had a privilege escalation vulnerability that allowed unauthenticated attackers to register an account with an arbitrary role, including Administrator. Arkenon's Frontend Login and Registration Blocks plugin for WordPress had a privilege escalation vulnerability that allowed authenticated attackers to change arbitrary user passwords.Artbees' Jupiter X Core plugin for WordPress had a PHP Object Injection vulnerability that allowed attackers to inject a PHP Object through a PHAR file. Ashraful Sarkar Naiem's License For Envato had a PHP Remote File Inclusion vulnerability that allowed PHP Local File Inclusion. Cajka's Verification SMS with TargetSMS plugin for WordPress had a limited Remote Code Execution vulnerability that allowed unauthenticated attackers to execute any callable function on the site.