Get $45 to spend when you get a Costco Gold Star Membership for $65
Macworld Life is expensive, but it may be a little easier to manage if you start consolidating your errands into one location: Costco. Sure, a Gold Star Membership costs $65, but now it also comes with a $45 Digital Costco Shop Card. That’s $45 to spend in person or online at Costco. Here’s how to make that happen:  First, you have to either be a new member or have had your membership expire for 18 months or longer. If you’ve been putting off renewing your membership, here’s your sign.  Next, you’ll buy your Costco Gold Star Membership here for $65. That’s the same price you’d normally pay, by the way. Important: make sure to use a valid email when you sign up. That’s because within two weeks of redeeming your membership, you’ll get your $45 Digital Costco Shop Card in your inbox.  All that’s left is to go shopping. You can use your $45 in-person or online. How many hotdogs would that cover?  It might be time to trade all those little errands for a trip to Costco.  Get a Costco 1-Year gold Star Membership and a $45 Digital Costco Shop Card for $65.    Costco 1-Year Gold Star Membership + $45 Digital Costco Shop Card – $65 See Deal StackSocial prices subject to change. 

Read more »

Parallels Can Now Run x86 Windows and Linux On Apple Silicon Mac
Parallels Desktop now supports running 64-bit x86 operating systems on Apple Silicon Macs through its proprietary emulation engine, enabling users to run traditional Windows and Linux distributions. However, performance is said to be "really slow." How-To Geek reports: The latest Parallels Desktop 20.2 update adds early support for x86 emulation on Apple Silicon, allowing traditional x86 PC operating systems to work on newer Mac computers. There were already apps like UTM that could do it (most of them are based on QEMU), but this feature uses Parallels' "proprietary emulation engine" paired with Apple's built-in hypervisor. [...] Parallels on Apple Silicon can now "run existing x86_64 Windows 10, Windows 11*, Windows Server 2019/2022, and some Linux distributives with UEFI BIOS via Parallels Emulator." You can also create new Windows 10 21H2 and Windows Server 2022 virtual machines if needed. There are some big limitations. You can only run 64-bit x86 operating systems -- sorry, FreeDOS fans -- but those 64-bit operating systems can run 32-bit applications. There's also no support for USB devices, nested virtualization (so WSL2 won't work), or the Parallels hypervisor. Performance will also be "really slow," since x86 instructions have to be translated to ARM. The company said, "Windows boot time is about 2-7 minutes, depending on your hardware. Windows operating system responsiveness is also low." Read more of this story at Slashdot.

Read more »

How to record audio and create transcripts in Notes in iOS 18
The Notes app in iOS 18 and iPadOS 18 makes it easy to add an audio recording to a note, and create a written transcription of it if desired. Here's how to do it.Notes can record audio and provide transcriptions, starting with iOS and iPadOS 18.It has long been possible to add an audio recording to a note created in the Notes app, but in earlier iOS versions it was a little more cumbersome. Users would open the Voice Memos app, record the audio, and then attach that recording to a new note in the Notes app.As of iOS 18, that functionality is directly available in Notes — though it is still somewhat hidden until you know how to find it. The big change compared to the previous Voice Memos app is that Notes can now also provide a written transcript of what was said, if you are using an iPhone 12 or later. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Copyright trial over Apple TV+ show 'Servant' could lead to $81 million fine
Apple TV+ show "Servant" allegedly stole key elements from a 2013 film called "The Truth About Emmanuel," and the trial is back on with a jury set to decide if Apple and M. Night Shyamalan should be fined $81 million.Apple TV+ show 'Servant.' Image source: AppleDirector Francesca Gregorini sued in January 2020, and the case was initially thrown out. She alleges that the dark themes surrounding a reborn doll and similar shots between the properties are enough to suggest copyright infringement.According to a report from Variety, creators of the show and M. Night Shyamalan will testify to a jury. The jurors will watch "The Truth About Emmanuel" and the first three episodes of "Servant" to help make a determination. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Vego Kitchen Composter review: keep food scraps out of the trash
If you're tired of smelly garbage, the Vego Kitchen Composter is a great way to responsibly dispose of food scraps — if you're fine with sacrificing the countertop space.Vego Kitchen ComposterFood waste is a big deal. While the numbers vary depending on your source, it's estimated that the average American throws away anywhere between 200 and 400 pounds of food a year.That might not seem like a big deal because that averages about 0.82 pounds of waste a day — about 2.5 apples or a little less than one russet potato. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Opera browser makes it easier to interact with its AI through a new iOS widget
The popular Opera web browser has just released a major update for its iPhone and iPad app. With the new version, Opera is making it easier for users to interact with Aria – the company’s built-in AI – through new Home Screen widgets. Read on as we detail everything that’s new with the latest Opera update for iOS. more…

Read more »

Save $250 to $300 on these M4 Pro MacBook Pros with exclusive deals
Always on a quest to bring readers the steepest savings, AppleInsider has partnered with B&H Photo to drop prices on two MacBook Pro configurations from Apple's M4 Pro line.Exclusive discounts are dropping MacBook Pros by up to $300.The first 14-inch MacBook Pro model features Apple's M4 Pro chip with a 12-core CPU and 16-core GPU. It also has 24GB of unified memory and a bump up to 1TB of storage. Normally retailing for $2,199, you can grab the laptop in Space Black for $1,949 when you shop through the pricing links in this post from a laptop or desktop computer (activation instructions can be found below). Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple releases third developer beta of watchOS 11.3 for testing
watchOS 11.3 has received its third developer beta, following the arrival of similar beta updates for the HomePod and Apple TV only hours earlier.Apple has released the third developer beta of watchOS 11.3.On Tuesday, Apple first released the third developer betas of tvOS 18.3 and HomePod OS 18.3, respectively. Now, the company has deployed a beta software release for its Apple Watch platform.The third developer beta of watchOS 11.3 increases the build number to 2S5550a, up from the previous 22S5540e, which was released on January 7, 2025. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

With President Trump inbound, EU reassesses tech probes into Apple, Google and Meta
The European Union (EU) is reassessing its investigations of tech groups including Apple and others, just as President Donald Trump… The post appeared first on MacDailyNews.

Read more »

watchOS 11.3 beta 3 now available for developers
Apple has released a new beta 3 update. Just hours after the recent debut of beta 3 for tvOS and HomePod only, watchOS 11.3 has received its beta 3 update too. more…

Read more »

Apple releases first MagSafe Charger firmware in nearly two years
Macworld Just like iPhones and iPads, Apple’s chargers and cables also have tiny computers inside that need occasional updates. Today it’s the MagSafe Charger’s turn—for the first time since May 2023. Apple has issued an update for the 25W MagSafe Charger to bring the accessory to a new firmware version from the previous version (128.0). This is the fifth firmware update the accessory has received but the first for the newest 25W model. There doesn’t appear to be a separate update for the older charger. Apple released the original MagSafe Charger, topped out at 15W and had a 1-meter cable, in 2020 alongside the iPhone 12. This updated model with 25W charging and a 2-meter cable arrived in September 2024 with the iPhone 16. There’s no way to directly update the MagSafe Charger. When it is attached to your iPhone, the firmware will be updated at some point, usually overnight. To check the firmware of your charger, attach it to your iPhone, then head to the Settings app, then General > About and tap the Apple MagSafe Charger tab near the bottom of the page. If the firmware version is later than 128.0, you are on the newest version.

Read more »

Why Vision Pro is Apple’s best reason yet to bring Touch ID back to iPhone
Apple introduced Face ID on iPhone all the way back in 2017, and Touch ID quickly became absent from all but the budget iPhone SE. Now, the SE is about to lose it too. But I think it’s actually the perfect time to bring Touch ID back across the entire iPhone lineup, and Vision Pro is why. more…

Read more »

Apple’s Calculator app will get one of its best features back in iOS 18.3
Macworld When iOS 18 launched last fall, we got an all-new Calculator app. It’s got some great features, including Math Notes, which lets you scribble down calculations to solve, and unit conversions, which converts things like currency and weight without heading to Safari. It even arrived on the iPad for the first time, with has a full set of features and a brand-new unified interface across platforms. But one of the most useful features of the old iOS calculator app didn’t make it to the new iOS 18 version: repeating operations. On the old Calculator, like most calculators, you were able to perform an operation, say 2×2, and press the equal sign to get 4. Then if you pressed the equal sign again, it would repeat the last operation (x2), and you’d get 8. Then again to get 16, and so on. It was a useful way to compute compounding interest or a long series of repeating additions, but for some reason, Apple took it away in iOS 18 and macOS 15. Maybe you didn’t notice, but many users did and have expressed frustration over the past few months that it was gone. In the iOS/iPadOS 18.3 and macOS 15.3 betas, the feature is back, and you can once again mash the equals key over and over and repeat the last operation to your heart’s content. Apple is expected to release the new updates in late January or early February, so you won’t have too long to wait.

Read more »

Apple TV+ unveils the second season trailer for ‘Eva the Owlet’
Apple TV+ on Tuesday revealed the trailer for the second season of the beloved animated kids and family series “Eva the Owlet,” premiering… The post appeared first on MacDailyNews.

Read more »

Apple joins Ultra Accelerator Link Consortium to help develop next-gen AI data center tech
Ultra Accelerator Link Consortium (UALink) has announced the expansion of its Board of Directors with the election of Apple, Alibaba Cloud… The post appeared first on MacDailyNews.

Read more »

The M2 MacBook Air is back under $800 right now
Macworld The MacBook Air M2 is a great deal at $999 especially now that it has 16GB of RAM. But right now, you can save $200 at Amazon, not quite the same fantastic discount we saw on Black Friday, but not far off either. This is one of the best laptops you can possibly get because it’s affordable, super light and thin, and perfectly capable of getting you through the day, whether you want to work, stream content, or have fun. The M2 chip is fast, powerful, and perfectly capable of handling everyday tasks, including some content creation. Paired with the 16GB of RAM it comes with, you’ve got a real speedy device at your fingers. The 13.6-inch Liquid Retina Display is absolutely gorgeous, and it’s actually one of our favorite things about this laptop. It also has a great battery life that will last you through the day without needing to hunt down your charger. Also, if you have to participate in video meetings often, you’ll be doing it in style because the laptop has a 1080p cam, a three-mic array, and a four-speaker sound system. Don’t miss out on the chance to get the M2 MacBook Air for $799 right now at Amazon. But we’d hurry up because this deal won’t last forever. Buy now at Amazon

Read more »

ChatGPT wants to become your reminder app with new ‘Tasks’ feature
OpenAI on Tuesday announced a new feature coming to ChatGPT, which will turn the chatbot into a reminder app. Called “Tasks,” the feature will let users ask ChatGPT to remind them about their tasks and even create periodic alerts for specific situations. more…

Read more »

Top tips for traveling with AirTags in your luggage
Traveling is a lot easier if you can track your stuff with AirTags in your luggage. Make sure it’s with you all along your journey. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple Watch Ultra 3 might get my upgrade for its software, not hardware
Apple Watch Ultra 3 is coming later this year. It will reportedly feature satellite connectivity, 5G cellular, and high blood pressure detection. But the thing that might win me over isn’t hardware, and it isn’t even actually new at all. more…

Read more »

Severance season 2 promos try to out-weird the show itself
With new episodes of Apple TV+'s strangely engrossing workplace series coming Friday, two new "Severance" season two promos get weird. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

OpenAI takes on Apple’s Siri with ‘Tasks’
OpenAI announced Tuesday the beta launch of "Tasks" for ChatGPT, marking its entry into the virtual assistant market and positioning it… The post appeared first on MacDailyNews.

Read more »

Apple seeds third developer beta of tvOS 18.3
Apple has moved on to its third round of developer betas, but it has started quietly with a trial of tvOS 18.3's third beta, along with HomePod OS 18.3.Apple TV 4KThe third beta for tvOS 18.3 follows after the second, which surfaced on January 7. The first round was issued on December 16.It's also accompanied by the third developer beta of HomePod OS 18.3, which is used by the HomePod and HomePod mini. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple releases beta 3 for tvOS 18.3 and HomePod 18.3
Apple released new betas today, but only for two of its platforms. tvOS 18.3 and HomePod 18.3 have received new developer beta 3 updates, bringing them ahead of the rest of Apple’s platforms in the beta cycle. more…

Read more »

Apple Watch Series 10 three-month review: Iterative isn't a bad word
The Apple Watch Series 10 has been on my wrist for three months now and it's clear that it's the best smartwatch Apple ever made. But that doesn't mean there aren't things that a future Series 11 could do better.The Apple Watch Series 10 looks great, if a little familiar.At this point, so early in the review, you're probably ready to scream "Apple Watch Ultra 2" at your screen. Don't worry, I haven't forgotten it, but the Apple Watch Ultra models are different and I'd argue the Series 10 is the better watch.For most Apple Watch buyers, the Ultras are just too big, too bulky, and too expensive. They come with features they don't need like cellular connectivity and a huge, rugged design that's built to deal with the great outdoors in ways the standard models aren't. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

The AirTag (4-Pack) is $29 Off
An item tracker can be very useful if you constantly lose your car keys, wallet, and other valuable items. Rather than paying full price, you can get ahead and take advantage of today’s deal, as the AirTag 4-pack is down to just $69.99 from its original price of $99 on Amazon. The Apple AirTag may […] The post appeared first on iLounge.

Read more »

‘New Look’ Apple Watch SE 3 may launch in 2025
Bloomberg’s Mark Gurman said that Apple would launch the next Apple Watch SE model with a ‘New Look’. In the latest ‘Power On’ newsletter, Gurman claims that the upcoming Apple Watch SE is just one of the many 2025 product launches. However, there are no further details as to what the ‘new look’ would be, […] The post appeared first on iLounge.

Read more »

Apple joins UALink group tasked with taking on Nvidia’s AI hardware dominance
Apple has officially gained a board seat on the Ultra Accelerator Link Consortium, a group of more than 65 members developing next generation AI accelerator architecture. Apple’s involvement will allow the company to influence the new standard and push for its adoption. That basically means that Apple will be involved in creating and promoting a standard for connecting a bunch of GPUs together in data centers powering AI tasks. more…

Read more »

Next iPad 11 might support Apple Intelligence
The upcoming base model iPad might have two upgraded features to make it eligible for Apple Intelligence. Mark Gurman of Bloomberg recently said in the latest Power On newsletter that the iPad 11 will have Apple Intelligence. To make that happen, Gurman mentioned that Apple will be upgrading the processor and memory of the tablet […] The post appeared first on iLounge.

Read more »

New iPad and iPhone SE models may debut this spring
Apple might be launching several products and accessories this spring, according to a Bloomberg report. The 2025 spring lineup might include the next iPhone SE, an iPad Air, the base model iPad, and Magic Keyboards for the tablets. The refreshed iPhone SE is said to be priced at under $500 and will have MagSafe and […] The post appeared first on iLounge.

Read more »

Get the Best Price For AirPods Pro 2 in 2025
Apple’s AirPods Pro 2 is discounted by $70 on Amazon, giving you great value for your money. The wireless earbuds comes with active noise cancellation for removing twice the background noise compared to the previous model, transparency mode letting you hear all around you, and adaptive audio which blends both of these smart noise control […] The post appeared first on iLounge.

Read more »

Microsoft: Happy 2025. Here’s 161 Security Updates
Microsoft today unleashed updates to plug a whopping 161 security vulnerabilities in Windows and related software, including three "zero-day" weaknesses that are already under active attack. Redmond's inaugural Patch Tuesday of 2025 bundles more fixes than the company has shipped in one go since 2017.

Read more »

A Day in the Life of a Prolific Voice Phishing Crew
Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound communications to their users, including emails, automated phone calls and system-level messages sent to all signed-in devices.

Read more »

U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea.

Read more »

Happy 15th Anniversary, KrebsOnSecurity!
KrebsOnSecurity.com turns 15 years old today! Maybe it's indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024's most engrossing security stories were about bad things happening to bad guys. It's also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).

Read more »

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm
Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey.

Read more »

How to Lose a Fortune with Just One Bad Click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click "yes" to a Google prompt on his mobile device.

Read more »

How Cryptocurrency Turns to Cash in Russian Banks
A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges -- none of which are physically located there.

Read more »

Patch Tuesday, December 2024 Edition
Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common… Read More »

Read more »

U.S. Offered $10M for Hacker Just Arrested by Russia
In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as "Wazawaka," a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Read more »

Why Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) -- such as .shop, .top, .xyz -- that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.

Read more »

Vulnerability Summary for the Week of November 25, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Portfolio Management System MCA  A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-26 7.3 CVE-2024-11744 1000 Projects--Portfolio Management System MCA  A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-27 7.3 CVE-2024-11819 1000projects -- beauty_parlour_management_system  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11646 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11647 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11648 1000projects -- beauty_parlour_management_system  A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11649 AbsolutePlugins--Absolute Addons For Elementor  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through 1.0.14. 2024-11-28 7.5 CVE-2024-52496 Advantech--EKI-6333AC-2G  A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (securityEngineID to local_record.engineid without proper bounds checking. 2024-11-27 3 CVE-2024-36468 Zabbix--Zabbix  When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd- >data in the code below will remain NULL and an attempt to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42328 Zabbix--Zabbix  The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd- >error will be NULL and trying to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42329 Zabbix--Zabbix  In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd- >browser heap pointer is freed by garbage collection. 2024-11-27 3.3 CVE-2024-42331 Zabbix--Zabbix  The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host. 2024-11-27 3.7 CVE-2024-42332 Zabbix--Zabbix  When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element. 2024-11-26 2.2 CVE-2024-22117 Zabbix--Zabbix  When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords. 2024-11-27 2.7 CVE-2024-36464 Zabbix--Zabbix  The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c 2024-11-27 2.7 CVE-2024-42333 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info autolab--Autolab  Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature. 2024-11-25 not yet calculated CVE-2024-53258 BoidCMS--BoidCMS  BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-25 not yet calculated CVE-2024-53255 bunkerity--bunkerweb  bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-27 not yet calculated CVE-2024-53264 Century Systems Co., Ltd.--FutureNet NXR-G110 series  FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs. 2024-11-29 not yet calculated CVE-2024-50357 Checkmk GmbH--Checkmk  Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link- >type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. 2024-11-25 not yet calculated CVE-2024-53099 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp: don't access released socket during error recovery") added a mutex_lock() call for the queue- >queue_lock in nvme_tcp_get_address(). However, the mutex_lock() races with mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below. DEBUG_LOCKS_WARN_ON(lock- >magic != lock) WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __x64_sys_openat+0x105/0x1d0 do_syscall_64+0x93/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncated--- 2024-11-25 not yet calculated CVE-2024-53100 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr- >ia_mode, attr- >ia_uid and attr- >ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. 2024-11-25 not yet calculated CVE-2024-53101 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: make keep-alive synchronous operation The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: Call Trace: autoremove_wake_function+0x0/0xbc (unreliable) __blk_mq_sched_dispatch_requests+0x114/0x24c blk_mq_sched_dispatch_requests+0x44/0x84 blk_mq_run_hw_queue+0x140/0x220 nvme_keep_alive_work+0xc8/0x19c [nvme_core] process_one_work+0x200/0x4e0 worker_thread+0x340/0x504 kthread+0x138/0x140 start_kernel_thread+0x14/0x18 While shutting down fabric controller, if nvme keep-alive request sneaks in then it would be flushed off. The nvme_keep_alive_end_io function is then invoked to handle the end of the keep-alive operation which decrements the admin- >q_usage_counter and assuming this is the last/only request in the admin queue then the admin- >q_usage_counter becomes zero. If that happens then blk-mq destroy queue operation (blk_mq_destroy_ queue()) which could be potentially running simultaneously on another cpu (as this is the controller shutdown code path) would forward progress and deletes the admin queue. So, now from this point onward we are not supposed to access the admin queue resources. However the issue here's that the nvme keep-alive thread running hw/hctx queue dispatch operation hasn't yet finished its work and so it could still potentially access the admin queue resource while the admin queue had been already deleted and that causes the above crash. This fix helps avoid the observed crash by implementing keep-alive as a synchronous operation so that we decrement admin- >q_usage_counter only after keep-alive command finished its execution and returns the command status back up to its caller (blk_execute_rq()). This would ensure that fabric shutdown code path doesn't destroy the fabric admin queue until keep-alive request finished execution and also keep-alive thread is not running hw/hctx queue dispatch operation. 2024-11-25 not yet calculated CVE-2024-53102 Mozilla--Firefox  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. 2024-11-26 not yet calculated CVE-2024-11696 Mozilla--Firefox  On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133. 2024-11-26 not yet calculated CVE-2024-11703 msg Suisse AG--EasyTax  A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS. 2024-11-29 not yet calculated CVE-2024-9044 n/a--n/a  FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. 2024-11-29 not yet calculated CVE-2024-35366 n/a--n/a  FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer 2024-11-29 not yet calculated CVE-2024-35367 n/a--n/a  FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. 2024-11-29 not yet calculated CVE-2024-35368 n/a--n/a  Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions. 2024-11-29 not yet calculated CVE-2024-35371 n/a--n/a  LinkStack 2.7.9 through 4.7.7 allows resourcesviewscomponentsfavicon.blade.php link SSRF. 2024-11-29 not yet calculated CVE-2024-35451 n/a--n/a  A deserialization vulnerability exists in the Stub class of the VarDumper module in Symfony v7.0.3. The vulnerability stems from deficiencies in the original implementation when handling properties with null or uninitialized values. An attacker could construct specific serialized data and use this vulnerability to execute unauthorized code. 2024-11-29 not yet calculated CVE-2024-36610 n/a--n/a  In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. 2024-11-29 not yet calculated CVE-2024-36611 n/a--n/a  Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. 2024-11-29 not yet calculated CVE-2024-36612 n/a--n/a  FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread. 2024-11-29 not yet calculated CVE-2024-36615 n/a--n/a  An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. 2024-11-29 not yet calculated CVE-2024-36616 n/a--n/a  FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. 2024-11-29 not yet calculated CVE-2024-36617 n/a--n/a  FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. 2024-11-29 not yet calculated CVE-2024-36618 n/a--n/a  moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. 2024-11-29 not yet calculated CVE-2024-36620 n/a--n/a  moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. 2024-11-29 not yet calculated CVE-2024-36621 n/a--n/a  In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter. 2024-11-29 not yet calculated CVE-2024-36622 n/a--n/a  moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. 2024-11-29 not yet calculated CVE-2024-36623 n/a--n/a  nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. 2024-11-29 not yet calculated CVE-2024-36671 n/a--n/a  MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. 2024-11-29 not yet calculated CVE-2024-45495 n/a--n/a  WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. 2024-12-01 not yet calculated CVE-2024-45520 n/a--n/a  OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. 2024-11-27 not yet calculated CVE-2024-46054 n/a--n/a  Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c. 2024-11-29 not yet calculated CVE-2024-48406 n/a--n/a  Incorrect access control in Adapt Learning Adapt Authoring Tool

Read more »

Apple has 8th generation iPads in stock today for only $229
Apple has Certified Refurbished 8th-generation 10.2" WiFi iPads available on their online store for only $229 in Space Gray or Silver colors. An Apple one-year warranty is included with each iPad, outer cases are new, batteries are new, and shipping is free: - 8th-gen 10.2" 32GB WiFi iPad: $229 These iPads may not last very long, so check Apple's site for the very latest stock status. They are the cheapest iPads for sale today at Apple. Keep an eye on our iPad Price Tracker for the latest prices & sales from Apple and its resellers, updated daily.

Read more »

Here’s how to use your Education discount to take up to $300 off new MacBooks at Apple
Need a new Apple MacBook Air or MacBook Pro? If you're a student, teacher, or staff member at any educational institution, you can use your .edu email address when ordering at Apple Education to take up to $300 off the price of a new MacBook. Even parents of students can qualify. Education discounts are also available on most build-to-order options, such as extra RAM and more storage. Here are the Apple Education discounts on standard-configuration MacBooks: - 16" M4 Pro MacBook Pros: from $2299, $200 off - 16" M4 Max MacBook Pros: from $3199, $300 off - 14" M4 MacBook Pros: from $1499, $100 off - 14" M4 Pro MacBook Pros: from $1849, $150-$200 off - 14" M4 Max MacBook Pros: from $2899, $300 off - 15" M3 MacBook Air/16GB/256GB: $1199, $100 off - 15" M3 MacBook Air/16GB/512GB: $1399, $100 off - 15" M3 MacBook Air/24GB/512GB: $1599, $100 off - 13" M3 MacBook Pro/16GB/256GB: $999, $100 off - 13" M3 MacBook Pro/16GB/512GB: $1199, $100 off - 13" M3 MacBook Pro/24GB/512GB: $1399, $100 off - 13" M2 MacBook Air/256GB: $899, $100 off Details at Apple Education. Not in the US? Click for the Canada store.

Read more »

Here’s how to use your Education discount to take up to $300 off new MacBooks at Apple
Need a new Apple MacBook Air or MacBook Pro? If you're a student, teacher, or staff member at any educational institution, you can use your .edu email address when ordering at Apple Education to take up to $300 off the price of a new MacBook. Even parents of students can qualify. Education discounts are also available on most build-to-order options, such as extra RAM and more storage. Here are the Apple Education discounts on standard-configuration MacBooks: - 16" M4 Pro MacBook Pros: from $2299, $200 off - 16" M4 Max MacBook Pros: from $3199, $300 off - 14" M4 MacBook Pros: from $1499, $100 off - 14" M4 Pro MacBook Pros: from $1849, $150-$200 off - 14" M4 Max MacBook Pros: from $2899, $300 off - 15" M3 MacBook Air/16GB/256GB: $1199, $100 off - 15" M3 MacBook Air/16GB/512GB: $1399, $100 off - 15" M3 MacBook Air/24GB/512GB: $1599, $100 off - 13" M3 MacBook Pro/16GB/256GB: $999, $100 off - 13" M3 MacBook Pro/16GB/512GB: $1199, $100 off - 13" M3 MacBook Pro/24GB/512GB: $1399, $100 off - 13" M2 MacBook Air/256GB: $899, $100 off Details at Apple Education. Not in the US? Click for the Canada store.

Read more »

Free iPhone 16 at Boost Mobile plus Unlimited service for $65 per month with Infinite Access
Boost Mobile, an MVNO using AT&T and T-Mobile's networks, is offering a free 128GB iPhone 16, 16 Plus, or 16 Pro including service with their Unlimited plan (30GB of premium data) for a total charge of $65 per month...their Infinite Access Plan. The per month charge includes a new iPhone every year, plus the Unlimited network access charge. No trade-in is required. iPhones with more storage are also available, but for a few dollars more per month. This deal is live today at Boost Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily.

Read more »

Free iPhone 16 at Boost Mobile plus Unlimited service for $65 per month with Infinite Access
Boost Mobile, an MVNO using AT&T and T-Mobile's networks, is offering a free 128GB iPhone 16, 16 Plus, or 16 Pro including service with their Unlimited plan (30GB of premium data) for a total charge of $65 per month...their Infinite Access Plan. The per month charge includes a new iPhone every year, plus the Unlimited network access charge. No trade-in is required. iPhones with more storage are also available, but for a few dollars more per month. This deal is live today at Boost Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily.

Read more »

Amazon is offering a $100 discount on 7th-generation 2024 iPad minis
Amazon is offering $100 discounts on Apple's new 2024 WiFi iPad minis, each with free shipping. These are the lowest prices available for new minis anywhere. - 8.3" 128GB WiFi iPad mini: $399, $100 off MSRP - 8.3" 256GB WiFi iPad mini: $499, $100 off MSRP - 8.3" 512GB WiFi iPad mini: $699, $100 off MSRP For the latest prices and sales, see our iPad mini Price Tracker, updated daily.

Read more »

14-inch M4 MacBook Pros on sale today for $150-$200 off MSRP
B&H Photo has 14-inch M4 MacBook Pros on sale right now for $150-$200 off MSRP. B&H offers free 1-2 day shipping to most US addresses: - 14" M4 MacBook Pro (16GB/512GB/Gray): $1449, $150 off MSRP - 14" M4 MacBook Pro (16GB/1TB/Gray): $1599, $200 off MSRP - 14" M4 MacBook Pro (24GB/1TB/Gray): $1799, $200 off MSRP These are currently the lowest prices available for new M4-powered 14" MacBook Pros among the Apple retailers we track. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

Clearance M2 Mac minis available starting at only $499
Best Buy has clearance M2 Mac minis available on their online store starting at $499. Sale prices for online orders only: - Mac mini M2 CPU (8GB/256GB): $499, save $100 - Mac mini M2 CPU (8GB/512GB): $599, save $200 For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Clearance 16-inch M3 Pro MacBook Pro (36GB/1TB) on sale for $2499, $400 off MSRP
Apple 16" MacBook Pros with M3 Pro CPUs are on clearance sale for $400 off original MSRP at B&H Photo. Snag a Space Black model with 36GB of memory and a 512GB SSD for only $2499, $400 off Apple's original asking price. B&H offers free 1-2 day shipping to most US addresses: - 16" M3 Pro MacBook Pro (36GB/512GB): $2499, $400 off MSRP For the latest prices and sales, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon has Apple Watch SE models on sale today for $50 off MSRP
Amazon has Apple Watch SE models on sale right now for $50 off MSRP, each including free shipping. Their prices are the lowest currently available for SE Watches: - 40mm Apple Watch SE GPS: $199, save $50 - 44mm Apple Watch SE GPS: $299, save $50 - 40mm Apple Watch SE GPS + Cellular: $249, save $50 - 44mm Apple Watch SE GPS + Cellular: $279, save $50 Note that their sale prices may be restricted to certain band colors (see their site for details), and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

16-inch M4 Max MacBook Pros are on sale today for $400 off Apple’s MSRP
B&H Photo is offering a $350-$400 discount on new 16-inch MacBook Pros with M4 Max CPUs right now. B&H offers free 1-2 day shipping to most US addresses: - 16" M4 Max MacBook Pro (36GB/1TB/Black): $3149, $350 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP Their prices are the lowest available today for new 16" M4 Max MacBook Pros among the Apple retailers we track. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Clearance Mac mini with M2 Pro CPU on clearance sale for only $899, $400 off original MSRP
Best Buy has clearance M2 Pro Mac minis on sale for $400 off original MSRP, now only $899. Sale price for online orders only, in-store price may vary. Order online, and choose free shipping or free local store pickup (if available): - Mac mini M2 Pro CPU (16GB/512GB): $899, save $400 For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »