The better way to use Gemini on the Mac
Back in April, Google joined OpenAI and Anthropic in offering a dedicated Mac app for its AI chatbot software. Two months later, it’s clear that Gemini for Mac isn’t as good as it could be. more…

Read more »

Steve Jobs’ Apple Retail Store chief Ron Johnson: ‘Apple is going to win on AI’
Steve Jobs’ former retail chief Ron Johnson believes Apple is poised to dominate artificial intelligence, largely because the iPhone will be… The post appeared first on MacDailyNews.

Read more »

macOS 27: Everything we know about the next big Mac update
Macworld On June 8, Apple will officially reveal the follow-up to macOS 27 Tahoe, followed by a months-long beta cycle, and the official release of the new operating system in the fall. As for what to expect, since the development is all in-house at Apple, leaks aren’t as prevalent as hardware, so a lot of the features are seen for the first time at the WWDC keynote. However, we’ve heard about big changes to how Siri is implemented, along with tweaks to the Liquid Glass UI that was released with macOS Tahoe. We can also draw some conclusions based on Apple’s hardware plans. For example, Apple is rumored to release its first touchscreen MacBook Pro during the macOS 27 cycle, so it’s possible that macOS 27 could bring major interface changes related to the new machine. Leading up to WWDC, stay tuned to this page as we track all the latest macOS 27 rumors. We also have an Apple WWDC event live blog where we will be sharing expert commentary and our immediate reactions and what the news means to you. What’s coming in macOS 27: At a Glance New chatbot-style Siri app Release timeline for advanced Siri capabilities New Apple Intelligence features End of Intel Mac support Touchscreen features macOS 27 release date: When will macOS 27 be available? First developer beta: June 8, 2026 First public beta: July 2026 Final version: September 2026 Apple will debut macOS 27 at WWDC26. Apple’s Keynote presentation will be on June 8, 2026, and the company will highlight the key features. The official version of macOS 27 will not be available until later in 2027. In recent years, Apple has released macOS at the same time as iOS. The iOS release has been happening during the second week of September, so Monday, September 14, is our guess as to when macOS 27 becomes available to everyone. When will the macOS 27 beta be released? It isn’t necessary to wait until the fall to try out the new features in macOS 27, though. Apple will release a developer beta at WWDC – likely immediately after the keynote on June 8. Apple will then release a public beta in July. The beta cycle includes several iterations as Apple refines the software. Here’s how you can participate in the beta program.

Read more »

DEVONthink 4.3.1
Maintenance release refines the new Markdown parser and some image-generation AI models. ($99 new for standard and $199 for Pro, free update, 90.5 MB, macOS 13+)

Read more »

New iOS 27 designs reportedly coming to these iPhone apps
iOS 27 will be unveiled in mere days, and rumors indicate the update will bring new design changes in big and small ways to a variety of iPhone apps. Here’s what’s coming. more…

Read more »

New iOS 27 designs reportedly coming to these iPhone apps
iOS 27 will be unveiled in mere days, and rumors indicate the update will bring new design changes in big and small ways to a variety of iPhone apps. Here’s what’s coming. more…

Read more »

Typinator 10.1
Introduces at-a-glance display of statistics showing time saved, expansions, and corrections. ($29.99 annual subscription, free update, 47.5 MB, macOS 13+)

Read more »

Mactracker 8.3
Popular encyclopedia of Apple products updated with several throwback additions. (Free, 267.5 MB, macOS 11+)

Read more »

iOS 27: Everything we know about the 2026 iPhone update
Macworld Apple is still wrapping up development of iOS 26, but is already hard at work on the next major iPhone operating system release: iOS 27. With an unveiling coming in early June at WWDC, we’ve already heard a few rumors about what the next OS will have in store for our iPhones when it is released in September 2026. We also have an Apple WWDC event live blog where we will be sharing expert commentary and our immediate reactions and what the news means to you. iOS 27 could be one of Apple’s most important iPhone updates. The leaks and rumors suggest that Apple will be focused on performance and stability improvements, rather than new features. Siri is said to be getting a huge overhaul, with a new chatbot-like interface. Apple is also expanding its Apple Intelligence features, according to reports. The Camera app is also said to be getting new customization abilities. Plans change of course, and you shouldn’t consider anything to be set in stone until Apple makes a formal announcement. Here’s what we think we know so far. What’s coming in iOS 27: At a Glance Performance and stability improvements New Apple Intelligence features New chatbot-style Siri based on Gemini technology Camera app customization with new Advanced mode and widgets Read on for more detail about these changes and what else to expect.

Read more »

HomeKit Weekly: SwitchBot launches a battery-powered standing fan with Apple Home integration
Fans are one of those categories where true innovation is kind of hard to find. Ultimately, it’s just there to cool things and circulate air. SwitchBot recently launched its new SwitchBot Standing Circulator Fan, which caught my eye for its built-in battery and Matter (and therefore Apple Home) compatibility. Let’s take a closer look at what this portable fan actually offers and what you need to know before picking one up. more…

Read more »

Price cut: AirPods Max 2 hit new record low
The best deal yet on Apple’s AirPods Max 2 lets you save on the premium headphones, which bring big upgrades over the originals. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Lil Finder Guy pet was the gateway to building my own Mac apps with Codex
At the start of May, OpenAI released a playful feature inside its Codex desktop app for creating a virtual pet. This silly little addition solved my biggest challenge with Codex: what should I do with it? My first real task with Codex was putting together a virtual Lil Finder Guy for fun. A month later, I’m using two Mac apps that Codex built at my direction. Toying around with Codex Pets was the gateway for me to better understand its capabilities. more…

Read more »

With a new CEO incoming, Apple’s AI do-over starts Monday
Apple has reached a pivotal moment. When outgoing CEO Tim Cook takes the stage for the keynote at the company’s WWDC on Monday… The post appeared first on MacDailyNews.

Read more »

iPadOS 27: Four new iPad features being announced next week
Apple’s big WWDC keynote is almost here, and rumors indicate iPadOS 27’s unveiling will bring these four new features—plus a lot more. more…

Read more »

Touch ID coming to iPhone Ultra this fall, here’s why
This fall, Apple is launching a new foldable iPhone that rumors say will be called iPhone Ultra. And one of the more curious features of iPhone Ultra is the use of Touch ID instead of Face ID. Here’s why Apple’s reportedly making the switch. more…

Read more »

How to watch WWDC 2026 live on Apple TV, YouTube, Safari & web browsers
Apple will stream WWDC 2026 through the Apple TV app, its websites, and YouTube, giving viewers several ways to watch the company's biggest software event of the year. Besides reading here on AppleInsider, here's how to stay tuned in.WWDC 2026WWDC is Apple's annual developer conference, where the company previews updates for the iPhone, iPad, Mac, Apple Watch, Apple TV, and Vision Pro. Developers are the primary audience, but the keynote also gives consumers an early look at many of the features Apple plans to release later in the year.Both presentations are free to watch through Apple's streaming platforms. Apple also offers calendar links on its WWDC and Apple Events pages so viewers can add the sessions to their schedules before they begin.Apple kicks off WWDC 2026 with its keynote on Monday, June 8, at 1 p.m. Eastern. The presentation is expected to introduce the next major versions of Apple's operating systems, along with new platform features and developer technologies. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Latest foldable iPhone leak improbably says Apple hasn't decided on colors yet
Apple's first foldable iPhone may be just months away, but anyone hoping for a stealth black iPhone Fold may have to look elsewhere if the latest leak turns out to be accurate.The iPhone Ultra might not come in a familiar black hueWith the clock ticking down to an expected September unveiling, we're seeing more and more iPhone Fold leaks by the day. The latest claims that even Apple doesn't yet know what colors the device will come in.Writing in a post to the Chinese social network Weibo, leaker Instant Digital hinted Apple is still deliberating whether to launch a black iPhone Fold. He even went so far as to wonder aloud whether Apple has a grudge against the color. Rumor Score: 🙄 Unlikely Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Watch this Franken-Neo come alive with official Apple parts
Macworld One of the cool things about the MacBook Neo is that it’s designed so the user can repair it if needed. You can order parts online and use Apple’s manuals to, say, replace a broken trackpad. But as it turns out, Apple doesn’t require you to buy the same-colored parts as your MacBook Neo. You could, for example, buy a Citrus trackpad for your Indigo Neo or mix-and-match keycaps to create a multi-colored rainbow MacBook Neo. That’s exactly what Antonio G. Di Benedetto did at The Verge. After purchasing an Indigo MacBook Neo, he went to the Self Service Repair Store, bought parts of different colors, and used those parts to replace some of the Indigo-colored ones on the Neo. The result is a laptop with multiple splashes of color. @verge The MacBook Neo is Apple’s cheapest laptop, its most colorful, and its easiest to repair in years. And you can buy official replacement parts in all four of its colors. So that got us thinking: What if we bought a Neo just to see how funky we could make it look? #apple #macbook #macbookneo ♬ original sound – The Verge More important than the results, however, is the insight into how easy it is to replace parts on the MacBook Neo. It was relatively easy for Di Benedetto; replacing the trackpad, USB-C ports, and the bottom case went smoothly, but the trouble began when replacing the keycaps. Di Benedetto neglected to buy the tools from Apple needed to do this, so he used his own and ended up damaging some of the keycaps. The takeaway here if if you need to repair your Neo and you want to do it yourself, be sure to double-check for any necessary tools you’ll need on the Repair Store website.

Read more »

UK plans to jail tech execs if kids keep seeing nudes on devices
Per possible new policy, the UK threatens to jail tech execs like Apple's John Ternus if they fail to block the smutty stuff from kids' eyes. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Apple Arcade in June: Four new games added to the service
Macworld Gaming subscription services are all the rage now, but Apple Arcade isn’t a little different from the likes of PlayStation Plus, EA Play, or Xbox Game Pass. If you’ve got questions about it, we’ve got plenty of answers. Updated June 5, 2026: There are four new games on the service this month: Coffee Inc. 2+, Free Cell Solitaire: Card Game+, Mini Football Legends, and My Talking Tom 2+. What is Apple Arcade? Apple Arcade is a gaming subscription service for iPhone, iPad, Mac, and AppleTV that features several hundred games. The games are a mix of genres and styles, and include original games you’ll only find on the service and others that can be found on the regular App Store or even other platforms. Apple Arcade isn’t a streaming service like Xbox Live Cloud Gaming or GeForce NOW. Games must be downloaded onto your device in order to be played. What do I need to run it? Apple Arcade was made available as part of iOS 13, iPad OS 13, tvOS 13, and macOS Catalina or later. Some of the more visually-intensive games may only run well on newer hardware, though, and some Mac games require macOS 11 (Big Sur). How much does Apple Arcade cost? Apple Arcade costs $6.99/£6.99 per month, and you’ll also get a one-month free trial or you can get three months free if you purchase a new iPhone, iPad, Apple TV or Mac. To claim your free trial click here. You can get Apple Arcade for less than $6.99 a month if you subscribe for a year upfront. A year of Apple Arcade is $49.99/£49.99 (so $4.16 a month). If you’re currently on the $6.99 month-to-month plan and want to switch to the annual plan and save some money, you can do so on your iPhone or iPad. Open the App Store app, then tap your account icon in the upper right. Tap Subscriptions, then tap the entry for Apple Arcade. Here, you can switch to the annual plan. Apple Arcade is also included in the Apple One subscription bundles, which range from $20 a month to $38 a month and include access to Apple Music and Apple TV and iCloud storage. There is also a month free trial of Apple One. To claim the trial, or sign up for Apple One, click here. How do I sign up for Apple Arcade? There isn’t an Apple Arcade app—it’s built into the App Store. On your iPhone, iPad, or Mac open the App Store and look for the Apple Arcade tab at the bottom of the screen (or in the left column on macOS). A sign-up screen with a Try It Free button will appear. After the trial you’ll be charged either the monthly or annual fee, depending on your selection. When subscribing, you’ll need to enter your Apple ID password or use Touch ID or Face ID to sign in, and you’ll have to confirm your subscription purchase a few times. Once you’re done with the sign up, the Arcade section of the App Store shows what games are available to you. To access a game, tap on it in the App Store, then tap the Get button. When the game is done installing on your device, the Get button turns into a Play button, and you can tap it to launch the game. The game app icon will also appear on your device’s Home page. On the Apple TV, there actually is an Arcade app. Open that to see the sign-up offer. You’ll also find an Arcade tab within the App Store. Does my subscription include family sharing? Yes. One $6.99 per month subscription can be shared between up to six people (including you). How do I cancel Apple Arcade? First off, keep in mind that if you cancel Apple Arcade (either before your free trial is up or after subscribing), you won’t be able to keep playing the games unless you re-subscribe. If you’re okay with that, you can use the same process you use to cancel any other subscription service. Here’s the easiest way to do it on the iPhone and iPad: Open the App Store app and tap on your profile photo in the upper right. In the screen that pops up, press Subscriptions near the top of the page. You’ll then see a list of active subscriptions, and Apple Arcade should be listed there. Tap it. You’ll either see Cancel Free Trial or Cancel Subscription toward the middle of the page that appears. Tap whatever option is available, then Confirm Cancellation. And here’s how to cancel Apple Arcade on the Mac: Open the App Store app and then press the icon with your profile photo in the lower left. The Account window will appear, and you should then click View Information at the top of the window. Enter your password when/if prompted. When your Account Information appears, scroll down to the Manage section and click the Manage link to the right of Subscriptions. When the list of your active subscriptions appears, click Edit to the right of Apple Arcade. Toward the middle of the page that appears, you’ll see a button that says either Cancel Free Trial or Cancel Subscription. Click it, then click Confirm Cancellation and Confirm. Do Apple Arcade games have in-app purchases? No. In Apple’s words, “since every game includes access to the full experience, including all game features, content, and future updates, no additional purchases will be required.” Even games that have in-app purchases on the App Store won’t have any in Apple Arcade. Do Apple Arcade games have ads? Also no. On a related note, Apple says Apple Arcade has no ad tracking. Is Apple Arcade a game streaming service like GeForce NOW or Xbox Game Streaming? No. All Apple Arcade are downloaded. Are there demos for Apple Arcade games? No, and they’re not really necessary. Like App Store apps, games download quickly and can easily be removed if you don’t want to keep it anymore. Apple partly envisions Apple Arcade as a way of letting players try out games with more freedom than the App Store currently allows (which is basically none). In Apple’s words, “rather than pay upfront for each game, a subscription to Apple Arcade will give players the opportunity to try any game in the service without risk.” The service has a free trial, though, as we’ve seen with other Apple subscription services. Am I able to keep playing Apple Arcade games if I cancel my subscription? No. As with most subscription services, you only have access while you’re a subscriber. Can I use controllers with Apple Arcade games? Yes. In additional to traditional MFi (Made for iOS) controllers, you can pair some specific Bluetooth controllers for either PlayStation or Xbox with either your iPhone, iPad, or Apple TV. Since many Apple Arcade games are playable on Mac and Apple TV (where controller support is more common), many games will support them. Some games, especially those that are also available in the broader App Store and only for iPhone or iPad, have no controller support. Recently Apple relaxed the requirements for MFi controller certification, which may have grown out of the Apple Arcade negotiations. How often are new games released? Games are typically released on the first Friday of each month. There are some rare exceptions. What games have been released so far? There are over 200 games available for Apple Arcade, and the list grows all the time. TitlePublisherRelease DateA Slight Change of Sawblades+Yong Kian Chin05/02/24Alba: A Wildlife Adventureustwo12/11/20Alto’s Odyssey: The Lost CityTeam Alto / Snowman07/16/21Alto’s Adventure—RemasteredTeam Alto / Snowman03/25/22Arkanoid vs Space Invaders+TAITO Corporation11/07/24Angry Birds BounceRovio09/03/25Angry Birds ReloadedRovio07/16/21Asphalt 8: Airborne+Gameloft08/27/21Badland PartyHypeHype Oy05/06/22Balatro+Playstack09/26/24Ballistic BaseballGameloft10/18/19Barbie Color Creations+StoryToys Limited12/05/24BEAST: Bio Exo Arena Suit TeamOh BiBi02/01/24Beyond a Steel SkyRevolution Software06/26/20Big Time SportsFrosty Pop Games09/19/19Blackjack by MobilityWare+MobilityWare01/05/24Bleak SwordDevolver Digital09/19/19Bloons TD Battles 2+Ninja Kiwi03/07/24Boggle: Arcade EditionZynga12/05/24Bold Moves+Red Games Co.06/09/23Bridge Constructor+Headup GmbH02/04/22Card of DarknessPendleton Ward09/19/19Castle CrumbleOrbital Knight02/03/23Castlevania: Grimoire of SoulsKonami09/17/21Charrua SoccerBatovi Games02/07/20Chess Universe+Tilting Point05/04/23Cityscapes: Sim BuilderPlaystack05/04/23Clue: The Classic Mystery Game+Marmalade Game Studio03/24/23Coffee Inc. 2+Side Labs06/04/26Cooking Mama: Cuisine!Office Create Corp.06/17/22CornsweeperRobert Morrison01/05/24Cozy Caravan5 Lives Studios01/08/26Crayola AdventuresRed Games Co.03/07/24Crayola Create and Play+Red Games Co.10/29/21Crayola Scribble Scrubbie+Red Games Co.09/03/25Crazy Eights: Card Games+MobilityWare03/06/25CreaksAmanita Design07/10/20Cricket Through the AgesDevolver Digital09/19/19Crossword Jam+PlaySimple Games10/20/23Crossy Road+Hipster Whale10/08/21Crossy Road CastleHipster Whale02/28/20Cult of the LambDevolver12/04/25Cut the Rope 3SeptoLab UK10/13/23Cut the Rope RemasteredPaladin Studios04/02/21Cypher 007Tilting Point09/29/23Dandara: Trials of Fear+Raw Fury12/03/21Dead Cells+Playdigious12/02/22Dear ReaderLocal No. 1209/19/19Delicious — Miracle of Life+GameHouse11/24/23Dicey Dungeons+Distractionware05/02/24Disney Coloring World+StoryToys Entertainment05/04/23Disney Dreamlight ValleyGameloft12/05/23Disney Getaway Blast+Gameloft05/04/23Disney SpellStruckArtist Arcade05/04/23Doctor Who: An Unlikely HeistTilting Point04/07/23Dominoes: Classic Tile Game+MobilityWare10/02/25Doodle God UniverseJoyBits07/16/21Doodle Jump 2+Lima Sky02/06/25Doraemon Dorayaki Shop Story+Kairosoft Co.03/05/26Downwell+Devolver11/17/23Dredge+Black Salt Games04/02/26Drive Ahead! CarcadeDodreams Fairytale Company11/07/24Easy Come Easy GolfClaphanz02/04/21Episode XOXOEpisode Interactive01/06/23Everybody ShogiAltPlus08/07/25Fabulous – Wedding Disaster+GameHouse06/06/24FantasianMistwalker04/01/21Farming Simulator 20+Giants Software05/04/23FarmsideThe Label02/17/23Felicity’s DoorArea 3502/05/26FFIV: The After YearsSquare Enix12/09/24Final Fantasy+Square Enix01/10/25Final Fantasy IV (3D Remake)Square Enix12/09/24FinitySeabaa08/25/23Flow Free+Big Duck Games03/05/26Food Truck Pup+Game Start10/03/24Football Manager 2023 TouchSEGA11/08/22Free Cell Solitaire: Card Game+MobilityWare06/04/26Frogger in Toy TownKonami09/19/19Furistas Cat Cafe+Runaway10/03/24Galaga Wars+Bandai Namco11/12/21Game Dev Story+Kairosoft Co., Ltd06/18/21Game RoomResolution Games01/20/24Garden Tails: Match and GrowPlaydots, Inc.09/16/22Gear.Club StradaleEden Games04/08/22Getting Over It+Bennett Foddy05/04/23Gibbon: Beyond the TreesBroken Rules02/25/22Gin Rummy Classic+MobilityWare10/07/22Goat Simulator+Coffee Stain Publishing05/13/22Good Pizza, Great Pizza+Tapblaze05/07/26Grand Mountain Adventure+Toppluva04/28/23GrindstoneCapybara Games09/19/19Hearts: Card Game+MobilityWare01/07/22Helix Jump+Voodoo06/05/25Hello Kitty Island AdventureSunblink07/28/23Hidden Folks+Adriaan de Jongh01/28/22Hill Climb Racing+Fingersoft05/04/23Horizon Chase 2Aquiris Game Studio09/09/22Hot LavaKlei Entertainment09/19/19Hot Wheels: Race Off+Hutch Games12/05/24Human: Fall Flat+505 Games03/31/23HYKE: Northern Light(s)Akatsuki Games04/02/26I Love Hue Too+Zut Games02/05/26INKS.+State of Play Games06/25/21Iron Marines+Ironhide Irl05/04/23It’s Literally Just MowingProtostar01/10/25Japanese Rural Life AdventureGame Start09/15/23JellyCar WorldsWalaber Entertainment12/09/22Jeopardy! DailyFrosty Pop09/04/25Jeopardy! World Tour+Uken10/06/23Jet DragonGrezzo Co.06/16/23Jetpack Joyride+Halfbrick Studios07/23/21Jetpack Joyride 2Halfbrick Studios08/19/22Jigsaw Puzzle by MobilityWare+MobilityWare06/10/22Junkworld TDIronhide09/22/23Katamari Damacy Rolling LIVEBandai Namco04/03/25Kingdom Rush 5: Alliance TD+Ironhide Irl09/03/25Kingdom Rush Frontiers TD+Ironhide Irl11/12/21Kingdom Rush Vengeance TD+Ironhide Irl07/29/22Kingdom Two Crowns+Raw Fury05/04/23Kingdoms: Merge & BuildCherrypick Games08/18/23Knotwords+Zach Gage11/03/23Legends of Kingdom RushIronhide Game Studio06/11/21LEGO BrawlsThe Lego Group09/19/19LEGO Builder’s JourneyThe Lego Group12/19/19LEGO DUPLO World+StoryToys07/07/23LEGO Friends Heartlake Rush+StoryToys05/01/25LEGO Hill Climb Adventures+Fingersoft06/05/25LEGO Star Wars BattlesTT Games09/24/21LEGO Star Wars: CastawaysGameloft11/19/21Leo’s Fortune+1337 & Senri LLC06/25/21Let’s Go Mightycat!Ponos corporation08/07/25Limbo+Playdead05/04/23Lost in Play+Snapbreak Games06/05/25LumenLykkegaard International02/05/21MasterChef: Let’s Cook!Tilting Point09/03/21MasterpiecedBorderLeap12/01/23Mini Football LegendsMiniclip.com06/04/26Mini MotorwaysDinosaur Polo Club09/19/19Millionaire Trivia: TV Game+Uken06/30/23MonomalsPicomy11/01/19Monster Train+Good Shepherd Entertainment09/05/24Monument Valley+ustwo games02/02/21Monument Valley 2+ustwo games03/11/22Moonshot – A Journey HomeNoodlecake04/22/22My Bowling 3D+iWare Designs07/01/22My Dear Farm+HyperBeard Inc.02/06/25My Little Pony: Mane MergeGameloft12/16/22My Talking Angela 2+Outfit7 Limited09/08/23My Talking Tom+Outfit7 Limited08/12/22My Talking Tom Friends+Outfit7 Limited09/04/25My Talking Tom 2+Outfit7 Limited06/04/26My Town Home – Family Games+My Town Games05/04/23My Very Hungry CaterpillarStoryToys04/02/26MySimsElectronic Arts11/06/25MySims KingdomElectronic Arts11/06/25NARUTO: Ultimate Ninja Storm+Bandai Namco12/04/25NBA 2K24 Arcade Edition2K Sports10/24/23NBA 2K25 Arcade Edition2K Sports10/03/24NBA 2K26 Arcade Edition2K Sports10/16/25Nekograms+Hungry Sky08/10/23NFL Retro Bowl ’25New Star R&D09/04/24Nick Jr. Replay!Viacom05/07/26Oceanhorn 2: Knights of the Lost RealmCornfox & Bros.09/19/19Oceanhorn 3Cornfox & Bros.03/05/26Octodad: Dadliest Catch+Young Horses05/04/23Oddmar+Mobje Ltd.12/03/21Old Man’s JourneyBroken Rules11/18/22OutlandersPomelo Games09/19/19Outlanders 2Pomelo Games07/03/24Over the AlpsStave Studios09/19/19OverlandFinji09/19/19PAC-MAN Party RoyaleBANDAI NAMCO Entertainment10/18/19PAC-MAN 256+BANDAI NAMCO Entertainment12/05/24PatternedBorderLeap09/19/19Perchang WorldPerchang05/07/26PGA Tour Pro GolfHypGames02/06/25Piano Tiles 2+Koapps03/06/25Piffle+Hipster Whale10/02/25Play-Doh WorldScary Beasties08/07/25Pocket Card Jockey: Ride On!Game Freak01/20/23Pocket Love!+HyperBeard03/05/26Potion Punch 2+Monstronauts Inc.01/08/26PowerWash SimulatorFuturLab12/04/25PPKP+Shimada Toshiro05/04/23Pro Darts 2026+iWare Designs05/27/22Pro Snooker & Pool 2026+iWare Designs Ltd.04/15/22Prune+Joel McDonald04/29/22Puffies.Lykkegaard Europe04/03/25Punch Kick Duck+Shaun Coleman07/03/24Puyo Puyo Puzzle PopSega04/04/24Puzzle & Dragons StoryGungHo Online Entertainment12/05/23Rabbids MultiverseUbisoft06/06/24Reigns+Devolver Digital07/01/21Retro Bowl+New Star R&D06/23/23Retro Goal+New Star R&D06/23/23RetrocadeResolution Games02/05/26Return to Monkey Island+Devolver06/06/24Ridiculous Fishing EXVlambeer07/17/23Rodeo Stampede+Featherweight Games01/10/25RollerCoaster Tycoon Classic+Atari04/03/25Sago Mini Jinja’s GardenSago Mini01/08/26Sago Mini Trips+Sago Mini04/04/24Samba de Amigo: Party-To-GoSega08/29/23Sesame Street Mecha Builders+StoryToys04/03/25Sid Meier’s Civilization VII2K02/05/26Skate CitySnowman09/19/19Skate City: New YorkSnowman01/10/25Slay the Spire+Humble Bundle07/07/23Smash Hit+Mediocre10/03/24Snake.io+Kooapps05/04/23Sneaky SasquatchRAC709/19/19Solitaire StoriesRed Games Co.07/02/21SongPop PartyGameloft04/02/21Sonic Dash+Sega04/08/22Sonic Dream TeamSega12/05/23Sonic RacingSega09/19/19Sp!ngSMG Studio03/05/21SpaceInvaders InfinityGene EVOTAITO Corporation04/03/25Spades: Card Game+MobilityWare01/07/22Spider Solitaire: Card Game+MobilityWare10/07/22Spire BlastOrbital Knight sp.01/22/21Spongebob SquarePants: Patty PursuitNickelodeon05/28/20Spongebob: Patty Pursuit 2Viacom International12/04/25Squiggle DropNoodlecake01/27/23Star Trek: LegendsTilting Point LLC04/02/21Stardew Valley+ConcernedApe07/21/23Stitch.Lykkegaard Europe10/28/22Subway Surfers+Sybo Games12/04/25Subway Surfers TagSybo Games07/15/22Suika Game+Xgimi Limited09/03/25SUMI SUMI: Matching Puzzle+Imagineer Co.05/01/25Summer Pop!+Ocean Games05/02/24Summon QuestThe Label04/21/23Super Leap DayNitrome08/06/21Super Mega Mini PartyRed Games Co, LLC11/01/19Super Monsters Ate My Condo+PikPok04/04/24Super Stickman Golf 3+Noodlecake08/06/21Taiko no Tatsujin Pop Tap BeatBANDAI NAMCO Entertainment04/02/21Talking Tom Blast ParkOutfit7 Limited12/05/24Tamagotchi Adventure KingdomBandai Namco01/05/24Temple Run+Imangi Studios05/04/23Temple Run LegendsImangi Stuidios08/01/24Temple Run: Puzzle AdventureScopely, Inc.09/17/21Texas Hold’em Poker: Pokerist+KamaGames11/07/24The Battle of Polytopia+Midjiwan03/07/24The Game of Life 2+Marmalade Game Studio04/03/25The Last CampfireHello Games08/27/20The Oregon TrailGameloft04/02/21Thomas and Friends: Let’s Roll+StoryToys10/02/25Three Kingdoms HeroesKoei Tecmo Games01/10/25Time Locker+Sotaro Otsuka05/04/23tint.Lykkegaard International09/19/19Tiny Wings+Andreas Illiger10/15/21TMNT Splintered FateParamount Global05/04/23Trials of Mana+Square Enix01/10/25True Skate+True Axis01/08/26Toca Boca Jr. ClassicsSago Mini11/06/25Tomb of the Mask+Playgendary06/06/24Turmoil+Gamious12/05/23Ultimate 8 Ball Pool+HypGames05/07/26UNO: Arcade EditionMattel06/05/25Unpacking+Humble Bundle04/02/26Vampire Survivors+Poncle08/01/24Very Little Nightmares+Bandai Namco05/04/23Warped Kart RacersElectric Square05/20/22What the Car?Triband ApS05/04/23What the Clash?Triband ApS05/01/25What the Golf?Fig09/19/19Wheel of Fortune DailyFrosty Pop11/07/24Where Cards FallSnowman09/19/19Winding WorldsKO_OP05/15/20with My BuddyNeilo inc.05/01/25Words in ProgressGamious02/01/24Words of Wonders: Search+Fugo Bilisim05/01/25Worms Across WorldsTeam 1708/07/25WurdwebAran & Adriaan08/13/21Wylde FlowersStudio Drydock02/22/22Zen Koi Pro+LandShark Games07/03/24Zen Pinball PartyZEN Studios09/03/21Zookeeper WorldKiteretsu Inc.09/10/21

Read more »

Farewell to a ‘Ted Lasso’ icon: Anthony Head passes away at 72
Fans of "Ted Lasso" are mourning the loss of Anthony Head, the talented British actor best known in the Apple TV series as Rupert Mannion… The post appeared first on MacDailyNews.

Read more »

AirPods 4 are down to a cool $99 for those hot summer beats
Macworld Apple AirPods 4 View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Summer is nearly here, and just in time, Apple’s AirPods 4 are down to $99 from $129, the lowest they’ve been all year. They briefly dipped lower for Black Friday 2025, so this isn’t an all-time best, but $99 is a strong number for Apple’s current standard earbuds and an easy entry point if you’ve been holding out. If you absolutely hate earbuds with silicone tips, then you’ll love the fit of AirPods 4. When using them for long hours, these buds will be a lot more comfortable as you won’t have to deal with that in-ear pressure. The redesigned shape and shorter stem add to that, sitting more securely so they stay put during a walk or a quick jog. The H2 chip inside these buds improves sound quality over previous models. The call clarity also holds up well thanks to voice isolation and trimming background noise. The chip will also make pairing the buds to your other devices so much easier. Even better, they also switch between an iPhone, iPad, or Mac on their own. And when you forget where they are, you can use the Find My app to track their location. Personalized Spatial Audio and head-nod Siri replies are nice extras you get when picking the AirPods 4. The buds will keep you listening to your favorite songs for about five hours, although you’ll get about 30 hours with the case. At $99, the AirPods 4 are easy to recommend, especially since better deals are few and far between.

Read more »

Apple’s big AI redemption at WWDC 2026: Overhauled Siri, iOS 27, macOS 27, and more set for reveal on Monday
Apple is gearing up for what could be one of its most important Worldwide Developers Conferences in years. On Monday, June 8th… The post appeared first on MacDailyNews.

Read more »

Smart home diary: A fresh look as I start again in my new home
I’ve recently completed what must be a strong contender for the longest-running saga in selling one home and buying another. I won’t bore you with the details, but the entire process from start to finish was two years almost exactly to the day. I have sadly sacrificed my former spectacular city view but let’s just say it was a good move. I set an ambitious target of a fortnight for completing all the main home improvement work on my new apartment, and so far seem to be getting pretty close. This includes much of my new smart home setup … more…

Read more »

Brydge Max 13 review: Finally, a compelling Magic Keyboard alternative
Brydge Max 13 is an all-in-one keyboard, trackpad, and stand for iPad Pro that has the potential to outshine Apple's Magic Keyboard.Brydge Max 13 review: The new all-aluminum iPad keyboardWith a price tag pushing $400 in the U.S., post-tax, it's no surprise that competitors have been relentlessly releasing lower-priced options to the Magic Keyboard. Most, though, swap out premium materials for cheaper ones, like plastic.At times, it feels like a race to the bottom. Premium keyboards outside of Apple's have largely been few and far between. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple TV has its best summer lineup ever, here’s what’s coming
Apple TV has its best summer lineup ever this year, with compelling new and returning series—all kicking off today with Cape Fear, the excellent new thriller. Here’s everything new coming to Apple TV this summer. more…

Read more »

Deals: AirPods Pro 3, AirPods Max 2, Apple Watch from $219, black Trail Loop, MacBook Air, more
Today’s 9to5Toys Lunch Break is headlined by some of the AirPods 4 nearly 25% off, and the best price ever on AirPods Max 2. Alongside the most affordable Apple Watch Series 11 down at $299 ($100 off) and Apple Watch SE 3 down at $219, we also have a super rare discount hitting Apple’s latest black Ultra Trail Loop today and Spigen’s Athlex Trail Loop-style Apple Watch band at $20. Just be sure to also scope out these M5 MacBook Air models still up to $270 off. Head below for a closer look. more…

Read more »

Anthropic urges AI industry to develop ‘brake pedal’ as self-improving systems approach
Anthropic, a leading AI research company, has issued a public warning about the rapid advancement of artificial intelligence toward… The post appeared first on MacDailyNews.

Read more »

Anker’s versatile 2-in-1 Nano docking station is $40 off today
Macworld Anker Nano 13-in-1 docking station View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Anker’s uniquely versatile Nano docking station is down to $110 from $150, a $40 cut, and the cheapest this handy hub has ever been. This is such a cool dock to hub because it’s a 2-in-1 model. On the one hand, it’s a 13-in-1 docking station that can find its home near your laptop, and on the other hand, it’s a 6-in-1 hub you can take anywhere you go. Most docks live permanently on your desk, but this one lets you pop off a smaller hub and take essential ports with you when you head out. The main dock handles the usual desk duties. You get dual HDMI and DisplayPort outputs for external monitors, Ethernet for a stable wired connection, a bunch of USB-C and USB-A ports for accessories, an audio jack, and SD and TF card slots if you move photos or footage around. It’s easy and straightforward. Then, if you pop out the smaller hub, you get the SD card slots, a USB-A and USB-C on one side, an HDMI, USB-C upstream, and USB-C with PD-IN on the other. Now, while this dock supports a triple-screen setup, things are different on a Mac. According to Anker’s description, when hooked up to a Mac, external monitors mirror the same content rather than extending into separate screens. Also, video output runs through HDMI or DisplayPort only, not the USB-C ports, so plan your monitor connections accordingly. But those are specific issues. For most people, this 2-in-1 Anker docking station is a great pick at $110, handling your needs while at the office and while on the go.

Read more »

iOS 27 beta release date: When you can install the new iPhone update
iOS 27’s big unveiling is just days away, and if you’re interested in installing pre-release software on your iPhone, you won’t have to wait long for the beta. Here’s the expected iOS 27 beta release date. more…

Read more »

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta's "AI support assistant" bot into resetting account passwords.

Read more »

Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a frequent staging ground for cyber mischief from Russia's intelligence agencies.

Read more »

Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Read more »

Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States.

Read more »

CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

Read more »

Patch Tuesday, May 2026 Edition
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers -- including Apple, Google, Microsoft, Mozilla and Oracle -- fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.

Read more »

Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.

Read more »

Vulnerability Summary for the Week of April 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info n/a-- OVMS3 3.3.005 Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. 2026-05-01 10 CVE-2026-37541 https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  tendacn[.]com-- W308R Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25316 ExploitDB-44373VulnCheck Advisory: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change  tendacn[.]com--W3002R Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers. 2026-04-29 9.8 CVE-2018-25317 ExploitDB-44380VulnCheck Advisory: Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change  tendacn[.]com--FH303/A300 Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25318 ExploitDB-44381VulnCheck Advisory: Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change  Weaver Network Co., Ltd.--E-office Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC). 2026-04-30 9.8 CVE-2022-50993 https://service.e-office.cn/knowledge/detail/5https://cn-sec.com/archives/1453025.htmlhttps://bbs.chaitin.cn/topic/37https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet  synway[.]net-- SMG Gateway Management Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC). 2026-04-30 9.8 CVE-2025-71284 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yamlhttps://mrxn.net/jswz/synway-9-2radius-rce.htmlhttps://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsAhttps://www.synway.net/https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address  Directorist Booking--Directorist Booking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2. 2026-04-27 9.3 CVE-2026-22336 https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve  Directorist--Directorist Social Login Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4. 2026-04-27 9.8 CVE-2026-22337 https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve  Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. 2026-04-27 9.8 CVE-2026-32644 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  n/a--Automotive Grade Linux (AGL) AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently. 2026-05-01 9.8 CVE-2026-37531 https://gerrit.automotivelinux.org/gerrit/src/app-framework-mainhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a-- cannelloni v2.0.0 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. 2026-05-01 9.8 CVE-2026-37539 https://github.com/mguentner/cannellonihttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  Carlson Software--VASCO-B GNSS Receiver The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials. 2026-04-28 9.4 CVE-2026-3893 https://www.carlsonsw.com/support-and-training/https://www.cve.org/CVERecord?id=CVE-2026-3893https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json  Mersenne--Prime95 Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands. 2026-04-29 8.4 CVE-2018-25299 ExploitDB-44649Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH  xataboost--XATABoost CMS XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information. 2026-04-29 8.2 CVE-2018-25300 ExploitDB-44622Official Product HomepageVulnCheck Advisory: XATABoost CMS 1.0.0 SQL Injection via news.php  Easy MPEG--Easy MPEG to DVD Burner Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe. 2026-04-29 8.4 CVE-2018-25301 ExploitDB-44565Product ReferenceVulnCheck Advisory: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow  Alloksoft--Allok Video to DVD Burner Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution. 2026-04-29 8.4 CVE-2018-25303 ExploitDB-44518Official Product HomepageVulnCheck Advisory: Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH  Filehippo--Free Download Manager Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code. 2026-04-29 8.4 CVE-2018-25304 ExploitDB-44499Product ReferenceVulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH  Sysgauge--SysGauge Pro SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges. 2026-04-29 8.4 CVE-2018-25307 ExploitDB-44455VulnCheck Advisory: SysGauge Pro 4.6.12 Local Buffer Overflow SEH  donmik--Buddypress Xprofile Custom Fields Type BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. 2026-04-29 8.8 CVE-2018-25308 ExploitDB-44432Official Product HomepageVulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution  Alloksoft--WMV to AVI MPEG DVD WMV Converter Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious input containing shellcode with structured exception handler (SEH) overwrite to bypass protections and execute code with application privileges. 2026-04-29 8.4 CVE-2018-25314 ExploitDB-44365Official Product HomepageProduct ReferenceVulnCheck Advisory: Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow  Alloksoft--Video Joiner Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with structured exception handler (SEH) overwrite and shellcode to achieve code execution when the application processes the license registration input. 2026-04-29 8.4 CVE-2018-25315 ExploitDB-44364Official Product HomepageProduct ReferenceVulnCheck Advisory: Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name  marketingfire--Widget Options Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0. 2026-05-02 8.8 CVE-2026-2052 https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cvehttps://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534https://plugins.trac.wordpress.org/changeset/3481338/https://plugins.trac.wordpress.org/changeset/3514411/  Milesight--MS-Cxx63-PD An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. 2026-04-27 8.8 CVE-2026-20766 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  wclovers--WCFM Frontend Manager for WooCommerce The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. 2026-05-02 8.1 CVE-2026-2554 https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cvehttps://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386https://plugins.trac.wordpress.org/changeset/3483695/  opencats--OpenCATS OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete. 2026-04-28 8.1 CVE-2026-27760 https://chocapikk.com/posts/2026/opencats-installer-rce/https://github.com/opencats/OpenCATS/pull/706https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint  Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. 2026-04-27 8.8 CVE-2026-27785 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  Cockpit--Cockpit CMS Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server. 2026-04-29 8.8 CVE-2026-34965 https://github.com/agentejo/cockpithttps://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections  n/a--(UDS) & OBD-II (On Board Diagnostics for Vehicles) miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. 2026-05-01 8.8 CVE-2026-37536 https://github.com/miaofng/uds-chttps://github.com/openxc/uds-chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a--Open-SAE-J1939 (Daniel Martensson) collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt- >data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. 2026-05-01 8.1 CVE-2026-37537 https://github.com/DanielMartensson/Open-SAE-J1939https://github.com/collin80/Open-SAE-J1939https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  openampproject[.]org--OpenAMP v2025.10.0 OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. 2026-05-01 8.4 CVE-2026-37540 https://github.com/OpenAMP/open-amphttps://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a--MixPHP Framework 2.x Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to OpisClosureunserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution. 2026-05-01 8.4 CVE-2026-37552 https://github.com/mix-php/mixhttps://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phphttps://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975  benjaminprojas--WP Editor The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. 2026-05-01 8.8 CVE-2026-3772 https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cvehttps://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103https://plugins.trac.wordpress.org/changeset/3480577/  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0. 2026-04-30 8.1 CVE-2026-40600 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xmhttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  TRENDnet--TEW-821DAP A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer. 2026-05-02 8.8 CVE-2026-7607 VDB-360564 | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowVDB-360564 | CTI Indicators (IOB, IOC, IOA)Submit #806214 | Trendnet TEW-821DAP v1.12B01 CWE-120 Buffer Copy without Checking Size of Inputhttps://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_BO.md  carazo--Import and export users and customers The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page. 2026-05-02 8.8 CVE-2026-7641 https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cvehttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21https://plugins.trac.wordpress.org/changeset/3515646  Cozmoslabs--Profile Builder Pro The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory. 2026-05-02 8.1 CVE-2026-7647 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L13https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L13  Shenzhen Libituo Technology--LBT-T300-HW1 A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 8.8 CVE-2026-7674 VDB-360827 | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowVDB-360827 | CTI Indicators (IOB, IOC, IOA)Submit #800705 | Libtor Technology lbt-t300-hw1 closure, xreq). The NULL propagation chain through afb-context.c:110 (context- >credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context- >credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14. 2026-05-01 7.8 CVE-2026-37525 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) afb-daemon v19.90.0 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29. 2026-05-01 7.8 CVE-2026-37526 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) aglservice v17.1.12 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer. 2026-05-01 7.1 CVE-2026-37532 https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-levelhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) isotp-c openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information. 2026-05-01 7.1 CVE-2026-37535 https://github.com/openxc/isotp-chttps://github.com/openxc/isotp-c/blob/master/src/isotp/receive.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a-- Vanetza V2X v26.02 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver. 2026-05-01 7.5 CVE-2026-37554 https://github.com/riebl/vanetzahttps://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpphttps://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpphttps://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40595 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4060 https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1767https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1785https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40601 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-cpr6-mhgm-893whttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb- >prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings. 2026-05-02 7.5 CVE-2026-4061 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1748https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Hooks/SearchResults.php#L39https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Search.php#L152https://plugins.trac.wordpress.org/changeset/3503627/  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context - `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4062 https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/  n/a--libssh2 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. 2026-05-01 7.3 CVE-2026-7598 VDB-360555 | libssh2 userauth.c userauth_password integer overflowVDB-360555 | CTI Indicators (IOB, IOC, IOA)Submit #805564 | libssh2 Shell interface, gaining root-level access to the device. 2026-04-29 4.3 CVE-2018-25310 ExploitDB-44387Vulnerability AdvisoryVulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution  gnu--wget2 wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. 2026-04-29 4.8 CVE-2026-1858 https://www.tenable.com/security/research/tra-2026-37  wazuh--wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4. 2026-04-29 4.4 CVE-2026-26204 https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857https://github.com/wazuh/wazuh/releases/tag/v4.14.4  Oracle Corporation--Oracle Linux An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context. 2026-05-01 4.4 CVE-2026-35233 Oracle Advisory  n/a-- V2Board  v1.7.4 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis. 2026-05-01 4.9 CVE-2026-37505 https://github.com/v2board/v2boardhttps://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9  nextlevelbuilder--ui-ux-pro-max-skill A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet. 2026-05-01 4.3 CVE-2026-7596 VDB-360549 | nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingVDB-360549 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805510 | nextlevelbuilder ui-ux-pro-max-skill 2.5.0 Slide Generator Multiple Stored XSShttps://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/  n/a--Open5GS A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component. 2026-05-02 4.3 CVE-2026-7601 VDB-360558 | Open5GS AMF gmm-handler.c denial of serviceVDB-360558 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805675 | Open5GS v.2.7.6 Denial of Servicehttps://github.com/open5gs/open5gs/issues/4321https://github.com/open5gs/open5gs/commit/ebc66942b6f8f1fab2d640e71cf4e9f1a423b426https://github.com/open5gs/open5gs/releases/tag/v2.7.7https://github.com/open5gs/open5gs/  itsourcecode--Courier Management System A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. 2026-05-02 4.7 CVE-2026-7612 VDB-360569 | itsourcecode Courier Management System edit_user.php sql injectionVDB-360569 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #806275 | itsourcecode Courier Management System V1.0 SQL Injectionhttps://github.com/ltranquility/submit/issues/12https://itsourcecode.com/  ChatGPTNextWeb--NextChat A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-02 4.3 CVE-2026-7643 VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyVDB-360755 | CTI Indicators (IOB, IOC, IOA)Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policyhttps://github.com/ChatGPTNextWeb/NextChat/issues/6756https://github.com/ChatGPTNextWeb/NextChat/  n/a--crmeb_java A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7673 VDB-360826 | crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadVDB-360826 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800684 | crmeb crmeb_java 1.3.4 Unrestricted Uploadhttps://fx4tqqfvdw4.feishu.cn/docx/EgMOdHyq6oyxhux5vpJcr5cgnAf?from=from_copylink  kerwincui--FastBee A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7676 VDB-360829 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalVDB-360829 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800723 | kerwincui FastBee ≤ 1.2.1 Path Traversalhttps://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink  jsbroks--COCO Annotator A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7680 VDB-360833 | jsbroks COCO Annotator Data Endpoint datasets.py path traversalVDB-360833 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #801150 | jsbroks COCO Annotator 0.11.1 Absolute Path Traversalhttps://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter  AMTT--Hotel Broadband Operation System A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7697 VDB-360866 | AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionVDB-360866 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #803272 | Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System v1.0 SQL Injectionhttps://github.com/testnet0/testnet/issues/74  Telegram--Desktop A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7701 VDB-360870 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceVDB-360870 | CTI Indicators (IOB, IOC, IOA)Submit #804341 | Telegram Telegram Desktop

Read more »

Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.

Read more »

Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction  Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access  Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH  Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH  Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH  faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field  Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter  Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service  Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002  Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service  Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field  Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow  Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName  icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection  Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command  Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field  infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import  faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow  Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service  Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields  Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG  ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion  Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog  Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service  Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input  Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service  Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service  Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory  Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow  Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field  P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field  Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow  94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields  Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service  Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server  Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow  Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field  P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service  Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001  OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763  HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605  IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907  hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php  Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209  Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html  Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet  Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/  Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki  EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95  Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf  Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server  ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes  PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0  Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech  Back to top

Read more »

‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.

Read more »

Apple’s 11″ A16 iPad Still $50 Off at Amazon & Walmart
Amazon and Walmart are both offering Apple’s 11-inch A16 iPad for $299, down from Apple’s standard $349 MSRP. That’s a straightforward $50 discount on Apple’s newest entry-level iPad, and still one of the easiest Apple deals to recommend right now. Check Amazon’s pricing here. Walmart is matching the same $299 price and also gives buyers the option to order online for free shipping or free local store pickup where available. Browse Walmart’s current pricing here.For the latest sales and deals, see our iPad Price Tracker, updated daily.

Read more »

Amazon Cuts Prices on Standard 16″ M5 Max MacBook Pros by $250
Amazon is now offering $250 discounts on Apple's two standard 16-inch M5 Max MacBook Pro Space Black configurations, bringing both models well below Apple's MSRP. The 36GB RAM/2TB SSD model has dropped to $3649, while the 48GB RAM/2TB SSD version is now available for $4149. Check current Amazon pricing here. Both configurations are seeing the same discounts, making this one of the simplest MacBook Pro sales we've seen recently. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Midnight 15″ M5 MacBook Air Drops to $1099 at Amazon & B&H
Amazon and B&H are both offering the Midnight 15-inch M5 MacBook Air with 16GB RAM and a 512GB SSD for just $1099, down from Apple’s standard $1299 MSRP. That works out to a clean $200 discount, making this one of the best prices currently available on Apple’s larger MacBook Air. Check Amazon's pricing here. B&H is matching the same $1099 sale price while also offering free 1–2 day shipping to most U.S. addresses. Browse current B&H pricing here. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

MacBook Neo Remains Fully In Stock at Walmart — Free Shipping & Pickup Available
The MacBook Neo continues to remain fully in stock across Walmart’s online store, making it one of the easiest places right now to buy Apple’s newest budget-friendly MacBook without waiting through extended delivery windows. Check current MacBook Neo availability at Walmart. Walmart is currently offering fast free shipping on MacBook Neo orders, along with free local store pickup (where available). While stock levels continue to fluctuate at other Apple retailers, Walmart remains one of the few places where the full Neo lineup appears broadly available.For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.

Read more »

Space Black 14″ M5 MacBook Pro Drops to $1499 at Amazon
Amazon is now offering Apple's Space Black 14-inch M5 MacBook Pro (16GB RAM/1TB SSD) for just $1499, down from Apple's standard $1699 MSRP. That works out to a clean $200 discount, making it one of the best prices currently available on Apple's newest 14-inch MacBook Pro. Check current Amazon pricing here. What's especially notable is that this discount applies to the upgraded 1TB configuration rather than a lower-storage model. Combined with Amazon's fast shipping, it's one of the stronger MacBook Pro deals available right now.For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Metro Makes Apple’s iPhone 16e Effectively Free — Plus a Free $100 Visa Card
Metro by T-Mobile is now offering one of the more aggressive prepaid iPhone deals currently available, giving switchers Apple’s iPhone 16e effectively for free when they bring over their existing number. Customers pay $99.99 upfront for the 128GB iPhone 16e, then receive a $100 virtual prepaid Mastercard after maintaining qualifying service for three months, offsetting the entire device cost. Metro is also including instant savings at checkout, making this one of the simpler no-trade-in iPhone offers currently available. See this deal on Metro's website. For additional iPhone sales and carrier promotions, visit our iPhone Price Tracker, updated regularly.

Read more »

Amazon Slashes 13″ & 15″ M5 MacBook Air Prices by $200 off Apple MSRP, prices now start at only $899
Amazon has increased its End of Memorial Day discounts on Apple's entry-level M5 MacBook Air lineup, dropping both the 13-inch and 15-inch 16GB/512GB models by $200 below Apple's MSRP. The 13-inch model is now available for about $899, while the larger 15-inch version has fallen to roughly $1099. Shop the 13-inch deal here. These are some of the lowest prices we've seen so far on Apple's newest MacBook Air models, making right now a particularly attractive time to buy. View the 15-inch deal here. For the latest sales and deals, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, updated daily.

Read more »

14″ M5 MacBook Pros on Sale at Amazon & B&H — Up to $200 Off Apple Pricing
Amazon and B&H are both offering discounts on Apple's popular 14-inch M5 MacBook Pro configurations, with the 16GB/1TB model now selling for $200 below MSRP and the 24GB/1TB version discounted by $150. Check current Amazon pricing here. While Amazon offers fast shipping and broad availability, B&H matches many of the same sale prices while adding free 1–2 day shipping to most U.S. addresses. Browse current B&H pricing here. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Memorial Day Sale: 13″ M5 MacBook Airs Return to $150
Amazon has brought back its $150-off pricing on Apple’s 13-inch M5 MacBook Air lineup for Memorial Day weekend, with discounts available across multiple configurations. The popular 16GB/512GB model is once again selling for about $949 instead of Apple’s $1099 MSRP, while higher-capacity models are seeing the same $150 discount. Check current Amazon pricing here. The nice thing about this sale is its consistency—every major 13-inch M5 MacBook Air configuration is discounted by the same amount, making it easy to compare models without worrying about uneven pricing. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

15″ M5 MacBook Airs on sale again for $150 at Amazon — Lowest Prices Yet
Amazon is now offering some of the best pricing yet on Apple’s 15-inch M5 MacBook Air lineup, with $150 discounts across all configurations. The popular 16GB/512GB model has dropped to about $1149 from Apple’s $1299 MSRP, and similar savings are showing up on higher storage and memory options as well. Check current deals at Amazon. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Discounts Space Black 14″ M5 MacBook Pros by Up to $300 Off MSRP
Amazon is now offering some of the best prices we’ve seen so far on Apple’s Space Black 14-inch M5 MacBook Pro lineup, with discounts ranging from $199 to $300 below Apple’s standard MSRP. The base 16GB RAM/1TB SSD model is now down to $1499.99 versus Apple’s $1699 MSRP, while the upgraded 32GB RAM/1TB SSD version has dropped to $1799 compared to Apple’s $2099 MSRP. Check current Amazon pricing here. The middle 24GB RAM/1TB SSD configuration is also discounted to $1749, or $150 below Apple pricing. Together, these are currently among the lowest prices available for Space Black 14″ M5 MacBook Pro models from Apple’s major retailers. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon Cuts Prices on 16″ M5 Pro/Max MacBook Pros — $250 Off MSRP
Amazon is now discounting Apple’s entire 16-inch M5 Pro and M5 Max MacBook Pro lineup by $250 off MSRP, with every listed configuration currently reduced below Apple’s standard pricing. The sale includes both Black and Silver models across the M5 Pro and M5 Max families, with prices starting at $2449.99 for the 24GB/1TB M5 Pro configuration. Check current Amazon pricing here. Higher-end M5 Max models are also seeing the same consistent $250 discounts, including the 36GB/2TB configuration at $3649.99 and the 48GB/2TB version at $4149.99. See these models here. These are currently the lowest prices available among Apple’s major retailers. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »