Flowise AI's Flowise version 3.0.5 has a critical remote code execution vulnerability where user input in the CustomMCP node is executed as JavaScript without validation. This allows access to sensitive Node.js modules, and has been fixed in version 3.0.6. HaruTheme's WooCommerce Designer Pro, up to version 1.9.24, suffers from an unrestricted file upload vulnerability. Iron Mountain's enVision software experiences command injection before version 250563. TalentSys Consulting's Inka.Net also has command injection issues before version 6.7.1. The Podlove Podcast Publisher WordPress plugin, up to version 4.2.6, allows arbitrary file uploads through its 'move_as_original_file' function. WooCommerce Uni CPO (Premium) plugin, up to version 4.9.54, has similar arbitrary file upload vulnerabilities. Red Hat's Nx build system package and its plugins were compromised via a supply-chain attack, stealing credentials. Cisco's Adaptive Security Appliance and Threat Defense software have vulnerabilities allowing arbitrary code execution via crafted HTTP requests. Cisco's IOS, IOS XE, and IOS XR software also have code execution flaws due to improper input validation in HTTP requests. Qualcomm Snapdragon processors have memory corruption vulnerabilities in handling RTP packets and during PLMN selection. SolarWinds Web Help Desk has an unauthenticated deserialization RCE vulnerability. Airship AI's Acropolis is vulnerable due to a default administrative account with static credentials. WAGO Device Sphere's web application database is exposed without authentication. Yonisink's Custom Post Type Images WordPress plugin has a CSRF vulnerability leading to code injection. Cloud-hosted Flowise experienced cross-tenant data exposure via the Custom JavaScript Function node. DNN Platform's Prompt module, prior to version 10.1.0, allows for script execution. Horilla HRMS has a stored XSS vulnerability in its ticket comment editor. ADB MCP Server is vulnerable to command injection in its tool definitions. Flag Forge CTF has session invalidation issues allowing authenticated users continued access after logout.