Several software products have been identified with significant vulnerabilities. VaulTLS versions prior to 0.9.1 suffer from an authentication bypass, allowing logins with empty passwords. Elite Video Player up to version 10.0.5 has a cross-site scripting vulnerability. Ads.txt Guru Connect, up to version 1.1.1, is susceptible to Cross-Site Request Forgery. Audiobookshelf versions 2.6.0 through 2.26.3 have an OpenID Connect callback vulnerability leading to account takeover. Aiven-db-migrate versions prior to 1.0.7 contain privilege escalation flaws in PostgreSQL migrations. BuddyPress XProfile Custom Image Field up to version 3.0.1 allows path traversal. FunnelKit Automations and Funnel Builder plugins expose sensitive information via a shortcode. Pin WP versions prior to 7.2 allow unrestricted file uploads of dangerous types. Eventin AI Powered Event Manager, up to version 4.0.37, has a server-side request forgery vulnerability. Ashlar-Vellum Cobalt and related products, prior to 12.6.1204.204, have multiple vulnerabilities leading to arbitrary code execution due to improper file parsing. AVEVA PI Integrator allows authenticated users to persist executable files. NEX-Forms, up to version 9.1.3, is vulnerable to CSRF. ZoloBlocks, up to version 2.3.2, has a PHP remote file inclusion vulnerability. Belkin AX1800 version 1.1.00.016 has a firmware update handler vulnerability. Screenshot-desktop versions prior to 1.15.2 allow command injection. SEOPress for MainWP, up to version 1.4, has a PHP remote file inclusion vulnerability. Oik, up to version 4.15.2, has a cross-site scripting vulnerability. SureDash, up to version 1.0.3, has an incorrect privilege assignment vulnerability. Bravis User and Case Theme User plugins, up to versions 1.0.0 and 1.0.3 respectively, have authentication bypass vulnerabilities. Centreon web versions are affected by SQL injection vulnerabilities in event logs and meta service indicator pages. Caliris, up to version 1.5, and Paid Member Subscriptions, up to version 2.15.4, have PHP remote file inclusion vulnerabilities. WP Webhooks, up to version 3.3.5, allows arbitrary file copy. CM Map Locations, up to version 2.1.6, has a cross-site scripting vulnerability.