The 10Web Booster WordPress plugin has a critical vulnerability allowing authenticated subscribers to delete arbitrary folders due to insufficient file path validation. Advantech iView versions prior to 5.7.05.7057 are susceptible to SQL injection via unsanitized SNMP v1 trap requests. The Aimeos GrapesJS CMS extension is vulnerable to stored XSS if Content Security Policy is disabled, with patches available in specific versions. Ajitdas Flex QR Code Generator plugin allows arbitrary file uploads by unauthenticated attackers due to missing file type validation. Akamai Guardicore Platform Agent for Windows has a local privilege escalation vulnerability; unprivileged users can gain SYSTEM privileges by creating a crafted configuration file. Argus Technology Inc. BILGER versions before 2.4.9 have an information insertion vulnerability related to message identifiers. Array Networks ArrayOS AG versions before 9.4.5.9 are vulnerable to command injection, with active exploitation reported. Auth0 node-jws versions up to 3.2.2 and 4.0.0 have an improper signature verification vulnerability when using the HS256 algorithm. Avast Antivirus is affected by multiple vulnerabilities on Windows and macOS, including privilege escalation, code execution, and denial of service, with various affected versions. The BACnet Protocol Stack library has a denial-of-service vulnerability due to out-of-bounds reads in the npdu_is_expected_reply function.