9to5Mac Daily: August 31, 2026 – Apple TV price hikes, more
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Stuff: Stuff helps you get everything out of your head and into a simple, elegant system—closing open loops and reducing mental stress. A simple to-do list for iPhone, iPad, and Mac, with powerful tools that make organizing, tracking, and checking off your tasks a whole lot more satisfying. Get Stuff done. more…

Read more »

9to5Mac Daily: August 31, 2026 – Apple TV price hikes, more
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Stuff: Stuff helps you get everything out of your head and into a simple, elegant system—closing open loops and reducing mental stress. A simple to-do list for iPhone, iPad, and Mac, with powerful tools that make organizing, tracking, and checking off your tasks a whole lot more satisfying. Get Stuff done. more…

Read more »

uGreen NASync DXP4800 Pro review: Sweet spot of price & performance
At $679.99, the four-bay uGreen NASync DXP4800 Pro NAS is a capable mid-range NAS for creators and small teams in the Apple ecosystem, with an excellent value proposition.uGreen NASync DXP4800 ProuGreen has built out its NAS range quickly since entering the category. AppleInsider has covered uGreen NAS hardware before, including the DXP4800 GT.The DXP4800 Pro sits above the GT and Plus in the four-bay lineup. It pairs a six-core Intel chip with generous memory headroom. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

uGreen NASync DXP4800 Pro review: Sweet spot of price & performance
At $679.99, the four-bay uGreen NASync DXP4800 Pro NAS is a capable mid-range NAS for creators and small teams in the Apple ecosystem, with an excellent value proposition.uGreen NASync DXP4800 ProuGreen has built out its NAS range quickly since entering the category. AppleInsider has covered uGreen NAS hardware before, including the DXP4800 GT.The DXP4800 Pro sits above the GT and Plus in the four-bay lineup. It pairs a six-core Intel chip with generous memory headroom. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple accuses OpenAI of destroying evidence as trade-secrets fight intensifies
Apple ratcheted up its lawsuit against OpenAI on Monday, telling a federal judge that the ChatGPT maker is destroying evidence while… The post appeared first on MacDailyNews.

Read more »

Save up to $1600 on Roborock products, including the flagship Saros 20
It’s Roborock’s 12th anniversary, and the high-tech cleaning company is celebrating by offering generous discounts across its range of robot cleaners and other products between now and September 6. Discounts range from 25% to over 50% across the products and bundles included in the anniversary sale, with savings as high as $1600 … more…

Read more »

Save up to $1600 on Roborock products, including the flagship Saros 20
It’s Roborock’s 12th anniversary, and the high-tech cleaning company is celebrating by offering generous discounts across its range of robot cleaners and other products between now and September 6. Discounts range from 25% to over 50% across the products and bundles included in the anniversary sale, with savings as high as $1600 … more…

Read more »

Save up to $1600 on Roborock products, including the flagship Saros 20
It’s Roborock’s 12th anniversary, and the high-tech cleaning company is celebrating by offering generous discounts across its range of robot cleaners and other products between now and September 6. Discounts range from 25% to over 50% across the products and bundles included in the anniversary sale, with savings as high as $1600 … more…

Read more »

Save up to $1600 on Roborock products, including the flagship Saros 20
It’s Roborock’s 12th anniversary, and the high-tech cleaning company is celebrating by offering generous discounts across its range of robot cleaners and other products between now and September 6. Discounts range from 25% to over 50% across the products and bundles included in the anniversary sale, with savings as high as $1600 … more…

Read more »

Save up to $1600 on Roborock products, including the flagship Saros 20
It’s Roborock’s 12th anniversary, and the high-tech cleaning company is celebrating by offering generous discounts across its range of robot cleaners and other products between now and September 6. Discounts range from 25% to over 50% across the products and bundles included in the anniversary sale, with savings as high as $1600 … more…

Read more »

Save up to $1600 on Roborock products, including the flagship Saros 20
It’s Roborock’s 12th anniversary, and the high-tech cleaning company is celebrating by offering generous discounts across its range of robot cleaners and other products between now and September 6. Discounts range from 25% to over 50% across the products and bundles included in the anniversary sale, with savings as high as $1600 … more…

Read more »

Codex report: Four months of building joy on my Mac with ChatGPT
9to5Mac is brought to you by Memoket: The Memoket Gem is an 11g AI wearable that slots beside your Apple Watch in a co-wear band. Press once to capture a conversation, and Gem connects it to what you discussed weeks ago — surfacing the earlier thread with a source link. From $179, shipping August 2026. In 2023, early adopters were just getting to know ChatGPT and AI chatbot tech. Three years later, OpenAI’s Codex agent, now part of the ChatGPT desktop app, has brought about a similar season of learning. Here’s how I’m using ChatGPT, Codex, and more on my Mac. more…

Read more »

Apple Caught Off Guard by AI Demand for Mac Mini and Mac Studio
According to The Information (paywalled), Apple reportedly moved up the release of new Mac mini and Mac Studio models after unexpectedly strong enterprise demand for Macs capable of running AI workloads. MacRumors reports: Apple normally releases new Mac models in the autumn, closer to October or November, making this week's announcement unusually early, falling just before the anticipated arrival of new iPhone models. The Information says that the AI-driven boom in Mac Studio and Mac mini sales is behind the early launch. Apple noticeably promoted the ability to link multiple Mac Studios together into a single, more capable system for running large frontier AI models, a feature aimed at business and developer customers rather than everyday consumers. Apple highlighted the Mac mini and Mac Studio's shift toward business buyers in June, with a "Business at the Park" event involving executives from major companies Ford, Disney, and Anthropic. The Mac mini was said to be the "darling" of the event. Even so, enterprise's rush toward powerful desktop Macs more broadly took Apple by surprise. The company reportedly did not possess an engineering team dedicated to business customers or staff focused on developer relations, and lacked an enterprise AI strategy. Businesses that approached Apple asking to buy access to the company's Private Cloud Compute infrastructure were reportedly turned down. Apple is instead leaning on partners such as WebAI and Mount Thor, which provide AI tools and execution environments built on Apple hardware. Read more of this story at Slashdot.

Read more »

Apple Caught Off Guard by AI Demand for Mac Mini and Mac Studio
According to The Information (paywalled), Apple reportedly moved up the release of new Mac mini and Mac Studio models after unexpectedly strong enterprise demand for Macs capable of running AI workloads. MacRumors reports: Apple normally releases new Mac models in the autumn, closer to October or November, making this week's announcement unusually early, falling just before the anticipated arrival of new iPhone models. The Information says that the AI-driven boom in Mac Studio and Mac mini sales is behind the early launch. Apple noticeably promoted the ability to link multiple Mac Studios together into a single, more capable system for running large frontier AI models, a feature aimed at business and developer customers rather than everyday consumers. Apple highlighted the Mac mini and Mac Studio's shift toward business buyers in June, with a "Business at the Park" event involving executives from major companies Ford, Disney, and Anthropic. The Mac mini was said to be the "darling" of the event. Even so, enterprise's rush toward powerful desktop Macs more broadly took Apple by surprise. The company reportedly did not possess an engineering team dedicated to business customers or staff focused on developer relations, and lacked an enterprise AI strategy. Businesses that approached Apple asking to buy access to the company's Private Cloud Compute infrastructure were reportedly turned down. Apple is instead leaning on partners such as WebAI and Mount Thor, which provide AI tools and execution environments built on Apple hardware. Read more of this story at Slashdot.

Read more »

Apple Caught Off Guard by AI Demand for Mac Mini and Mac Studio
According to The Information (paywalled), Apple reportedly moved up the release of new Mac mini and Mac Studio models after unexpectedly strong enterprise demand for Macs capable of running AI workloads. MacRumors reports: Apple normally releases new Mac models in the autumn, closer to October or November, making this week's announcement unusually early, falling just before the anticipated arrival of new iPhone models. The Information says that the AI-driven boom in Mac Studio and Mac mini sales is behind the early launch. Apple noticeably promoted the ability to link multiple Mac Studios together into a single, more capable system for running large frontier AI models, a feature aimed at business and developer customers rather than everyday consumers. Apple highlighted the Mac mini and Mac Studio's shift toward business buyers in June, with a "Business at the Park" event involving executives from major companies Ford, Disney, and Anthropic. The Mac mini was said to be the "darling" of the event. Even so, enterprise's rush toward powerful desktop Macs more broadly took Apple by surprise. The company reportedly did not possess an engineering team dedicated to business customers or staff focused on developer relations, and lacked an enterprise AI strategy. Businesses that approached Apple asking to buy access to the company's Private Cloud Compute infrastructure were reportedly turned down. Apple is instead leaning on partners such as WebAI and Mount Thor, which provide AI tools and execution environments built on Apple hardware. Read more of this story at Slashdot.

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple ends hardware support for three Intel MacBook models
Apple has ended official hardware support for three Intel MacBook models from 2017 and 2018, leaving owners to turn to third-party repair options.Apple's MacBook lineup continues to evolve, and some are aging out as Apple Silicon takes overThe first is the 13-inch 2017 MacBook Pro with two Thunderbolt 3 ports. The most recent compatible OS is macOS Ventura, which was released in 2022.Second is Apple's 2018 Retina MacBook Air. It can only be updated to macOS Sonoma, putting it two macOS releases behind at the time of publication. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New evidence shows OpenAI's trade secret theft & destruction of evidence, says Apple
Apple has been urging the court to require expedited discovery, and information discovered on Chang Liu's work MacBook suggests OpenAI is actively destroying evidence.Apple has sued OpenAI over alleged trade secret theftOpenAI poached over 400 employees from Apple to work on AI projects, and two were called out in a trade secret theft lawsuit in July. Apple has suggested the case needs urgent attention, and that every delay causes more harm.According to a new filing from Apple on Monday, the MacBook used by Chang Liu has a lot of evidence that has allegedly been ignored by defendants so far. OpenAI has been pushing back on Apple's attempts for expedited discovery, which Apple now asserts could be due to an active attempt to destroy evidence. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New evidence shows OpenAI's trade secret theft & destruction of evidence, says Apple
Apple has been urging the court to require expedited discovery, and information discovered on Chang Liu's work MacBook suggests OpenAI is actively destroying evidence.Apple has sued OpenAI over alleged trade secret theftOpenAI poached over 400 employees from Apple to work on AI projects, and two were called out in a trade secret theft lawsuit in July. Apple has suggested the case needs urgent attention, and that every delay causes more harm.According to a new filing from Apple on Monday, the MacBook used by Chang Liu has a lot of evidence that has allegedly been ignored by defendants so far. OpenAI has been pushing back on Apple's attempts for expedited discovery, which Apple now asserts could be due to an active attempt to destroy evidence. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New evidence shows OpenAI's trade secret theft & destruction of evidence, says Apple
Apple has been urging the court to require expedited discovery, and information discovered on Chang Liu's work MacBook suggests OpenAI is actively destroying evidence.Apple has sued OpenAI over alleged trade secret theftOpenAI poached over 400 employees from Apple to work on AI projects, and two were called out in a trade secret theft lawsuit in July. Apple has suggested the case needs urgent attention, and that every delay causes more harm.According to a new filing from Apple on Monday, the MacBook used by Chang Liu has a lot of evidence that has allegedly been ignored by defendants so far. OpenAI has been pushing back on Apple's attempts for expedited discovery, which Apple now asserts could be due to an active attempt to destroy evidence. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New evidence shows OpenAI's trade secret theft & destruction of evidence, says Apple
Apple has been urging the court to require expedited discovery, and information discovered on Chang Liu's work MacBook suggests OpenAI is actively destroying evidence.Apple has sued OpenAI over alleged trade secret theftOpenAI poached over 400 employees from Apple to work on AI projects, and two were called out in a trade secret theft lawsuit in July. Apple has suggested the case needs urgent attention, and that every delay causes more harm.According to a new filing from Apple on Monday, the MacBook used by Chang Liu has a lot of evidence that has allegedly been ignored by defendants so far. OpenAI has been pushing back on Apple's attempts for expedited discovery, which Apple now asserts could be due to an active attempt to destroy evidence. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New evidence shows OpenAI's trade secret theft & destruction of evidence, says Apple
Apple has been urging the court to require expedited discovery, and information discovered on Chang Liu's work MacBook suggests OpenAI is actively destroying evidence.Apple has sued OpenAI over alleged trade secret theftOpenAI poached over 400 employees from Apple to work on AI projects, and two were called out in a trade secret theft lawsuit in July. Apple has suggested the case needs urgent attention, and that every delay causes more harm.According to a new filing from Apple on Monday, the MacBook used by Chang Liu has a lot of evidence that has allegedly been ignored by defendants so far. OpenAI has been pushing back on Apple's attempts for expedited discovery, which Apple now asserts could be due to an active attempt to destroy evidence. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New evidence shows OpenAI's trade secret theft & destruction of evidence, says Apple
Apple has been urging the court to require expedited discovery, and information discovered on Chang Liu's work MacBook suggests OpenAI is actively destroying evidence.Apple has sued OpenAI over alleged trade secret theftOpenAI poached over 400 employees from Apple to work on AI projects, and two were called out in a trade secret theft lawsuit in July. Apple has suggested the case needs urgent attention, and that every delay causes more harm.According to a new filing from Apple on Monday, the MacBook used by Chang Liu has a lot of evidence that has allegedly been ignored by defendants so far. OpenAI has been pushing back on Apple's attempts for expedited discovery, which Apple now asserts could be due to an active attempt to destroy evidence. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

How to update an older Mac to a newer macOS
Using the latest version of macOS is always best from a security standpoint. But if your Mac is several years old, there’s a good chance that macOS Sonoma or macOS Sequoia won’t run on it. Thankfully, there’s an app for that. The post first appeared on The Mac Security Blog.

Read more »

How to update an older Mac to a newer macOS
Using the latest version of macOS is always best from a security standpoint. But if your Mac is several years old, there’s a good chance that macOS Sonoma or macOS Sequoia won’t run on it. Thankfully, there’s an app for that. The post first appeared on The Mac Security Blog.

Read more »

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.

Read more »

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.

Read more »

What is iCloud Private Relay and how do you use it?
iCloud Private Relay is a new privacy feature coming to macOS Monterey and iOS/iPadOS 15 this fall. The post first appeared on The Mac Security Blog.

Read more »

What is iCloud Private Relay and how do you use it?
iCloud Private Relay is a new privacy feature coming to macOS Monterey and iOS/iPadOS 15 this fall. The post first appeared on The Mac Security Blog.

Read more »

iCloud Private Relay vs. VPN: what’s the difference?
Apple's iCloud Private Relay is not a VPN, but Intego Privacy Protection is. Compare the two, and learn why Intego Privacy Protection is the best VPN for Mac. The post first appeared on The Mac Security Blog.

Read more »

iCloud Private Relay vs. VPN: what’s the difference?
Apple's iCloud Private Relay is not a VPN, but Intego Privacy Protection is. Compare the two, and learn why Intego Privacy Protection is the best VPN for Mac. The post first appeared on The Mac Security Blog.

Read more »

How to check your Mac for malware (and what to do if you find it)
9 things you can do if you think your Mac has malware. The post first appeared on The Mac Security Blog.

Read more »

How to check your Mac for malware (and what to do if you find it)
9 things you can do if you think your Mac has malware. The post first appeared on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of August 17, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 101gen--Automation Web Platform Notifications and OTP for WooCommerce, Advanced Country Code The Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address. 2026-08-21 9.8 CVE-2026-77264 10Web--Form Maker by 10Web Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web = 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64. 2026-08-18 7 CVE-2026-75857 Hmbown--CodeWhale CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64. 2026-08-18 7.8 CVE-2026-75858 Hmbown--CodeWhale CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration. 2026-08-18 7.5 CVE-2026-75859 Hmbown--CodeWhale CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent. 2026-08-18 7.8 CVE-2026-75911 Hmbown--CodeWhale CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model. 2026-08-18 7.4 CVE-2026-75912 Hmbown--CodeWhale CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval. 2026-08-18 7.5 CVE-2026-75914 Hmbown--CodeWhale CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context. 2026-08-18 7.5 CVE-2026-75915 hoppscotch--hoppscotch Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0. 2026-08-18 7.6 CVE-2026-69189 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file. 2026-08-19 9.1 CVE-2026-15065 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 9.9 CVE-2026-15068 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication. 2026-08-19 9.8 CVE-2026-16656 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 9.9 CVE-2026-16816 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation. 2026-08-19 9.3 CVE-2026-16822 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow. 2026-08-19 9.8 CVE-2026-16834 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser. 2026-08-19 9.4 CVE-2026-16839 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. 2026-08-19 9.8 CVE-2026-16840 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-19 9.8 CVE-2026-16845 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16862 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16864 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-19 9.8 CVE-2026-16872 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 9.8 CVE-2026-16882 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16885 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16894 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code or cause a denial of service due to an out-of-bounds write. 2026-08-19 9.6 CVE-2026-16903 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16913 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow. 2026-08-19 9.8 CVE-2026-16917 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers. 2026-08-19 9.8 CVE-2026-16919 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input. 2026-08-20 9.1 CVE-2026-16926 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.8 CVE-2026-17040 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability. 2026-08-20 9.8 CVE-2026-17118 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 9.8 CVE-2026-17122 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability. 2026-08-20 9.8 CVE-2026-17136 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.8 CVE-2026-17141 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication. 2026-08-20 9.8 CVE-2026-17142 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management. 2026-08-20 9.8 CVE-2026-17145 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.8 CVE-2026-17152 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-20 9.8 CVE-2026-17157 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation. 2026-08-20 9.8 CVE-2026-17160 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.3 CVE-2026-17422 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-20 9.9 CVE-2026-18835 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal. 2026-08-19 8.2 CVE-2026-15061 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates. 2026-08-19 8.1 CVE-2026-15078 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication. 2026-08-19 8.2 CVE-2026-16686 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-19 8.8 CVE-2026-16814 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 8.8 CVE-2026-16841 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 8.8 CVE-2026-16842 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 8.8 CVE-2026-16844 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-19 8.8 CVE-2026-16847 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options. 2026-08-19 8.8 CVE-2026-16848 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements. 2026-08-19 8.8 CVE-2026-16850 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS configuration due to improper authentication. 2026-08-19 8.2 CVE-2026-16857 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection. 2026-08-19 8.8 CVE-2026-16865 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-19 8.8 CVE-2026-16877 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. 2026-08-19 8.8 CVE-2026-16901 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking. 2026-08-19 8.8 CVE-2026-16909 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 8.8 CVE-2026-16911 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable. 2026-08-20 8.8 CVE-2026-16932 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap-based buffer overflow. 2026-08-20 8.8 CVE-2026-16934 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 8.8 CVE-2026-16936 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a heap-based buffer overflow. 2026-08-20 8.2 CVE-2026-16943 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an integer underflow. 2026-08-20 8.8 CVE-2026-16996 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication. 2026-08-20 8.1 CVE-2026-17000 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-20 8.3 CVE-2026-17006 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read. 2026-08-20 8.1 CVE-2026-17060 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 8.1 CVE-2026-17138 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 8.5 CVE-2026-17168 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. 2026-08-20 8.8 CVE-2026-17436 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer underflow. 2026-08-20 8.2 CVE-2026-18670 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-20 8.4 CVE-2026-18824 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. 2026-08-20 8.8 CVE-2026-18832 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer. 2026-08-20 8.2 CVE-2026-18840 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to an out-of-bounds write. 2026-08-20 8.4 CVE-2026-18842 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 8.1 CVE-2026-19437 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel. 2026-08-20 8.2 CVE-2026-19442 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root. 2026-08-20 8.8 CVE-2026-19449 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow. 2026-08-19 7.5 CVE-2026-14970 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16690 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. 2026-08-19 7.8 CVE-2026-16703 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. 2026-08-19 7.5 CVE-2026-16706 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. 2026-08-19 7.5 CVE-2026-16817 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16818 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition. 2026-08-19 7.7 CVE-2026-16819 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion. 2026-08-19 7.5 CVE-2026-16824 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16831 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16836 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate. 2026-08-19 7.5 CVE-2026-16837 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-19 7 CVE-2026-16838 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a use-after-free. 2026-08-19 7.4 CVE-2026-16851 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow. 2026-08-19 7.5 CVE-2026-16852 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables. 2026-08-19 7.8 CVE-2026-16869 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve local privilege escalation due to an out-of-bounds write. 2026-08-19 7.8 CVE-2026-16873 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles. 2026-08-19 7.8 CVE-2026-16874 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection. 2026-08-19 7.8 CVE-2026-16875 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-20 7 CVE-2026-16922 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. 2026-08-20 7 CVE-2026-16923 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation. 2026-08-20 7.5 CVE-2026-16924 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization. 2026-08-20 7.1 CVE-2026-16925 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-20 7.3 CVE-2026-16927 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. 2026-08-20 7.5 CVE-2026-16928 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-20 7.8 CVE-2026-16935 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. 2026-08-20 7.8 CVE-2026-16937 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 7.8 CVE-2026-16945 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap buffer overflow. 2026-08-20 7.8 CVE-2026-16946 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links. 2026-08-20 7.1 CVE-2026-16989 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic links. 2026-08-20 7.8 CVE-2026-16991 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management. 2026-08-20 7.8 CVE-2026-16997 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write. 2026-08-20 7.7 CVE-2026-17003 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation. 2026-08-20 7.7 CVE-2026-17024 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. 2026-08-20 7.5 CVE-2026-17121 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds read. 2026-08-20 7.8 CVE-2026-17124 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow. 2026-08-20 7.5 CVE-2026-17159 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field. 2026-08-20 7.5 CVE-2026-17163 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. 2026-08-20 7.5 CVE-2026-17165 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size. 2026-08-20 7.5 CVE-2026-17170 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links. 2026-08-20 7.8 CVE-2026-17171 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read. 2026-08-20 7.7 CVE-2026-17423 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack buffer overflow. 2026-08-20 7.5 CVE-2026-17425 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read. 2026-08-20 7.9 CVE-2026-18716 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart. 2026-08-20 7.5 CVE-2026-19446 IBM--DS8A00 (R10.0 - R10.1) IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service. 2026-08-19 7.4 CVE-2025-36254 IBM--DS8A00( R10.0 - R10.1 ) IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions. 2026-08-19 7.5 CVE-2025-36255 IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint. 2026-08-19 7.5 CVE-2026-19875 IBM--Portieris IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references. 2026-08-19 8.1 CVE-2026-18544 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 9.6 CVE-2026-16687 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 9.6 CVE-2026-16835 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.4 CVE-2026-16832 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.2 CVE-2026-16930 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 through OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.2 CVE-2026-16933 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level access to the BMC/FSP can supply specially crafted configuration data, compromising the host firmware boot stage and everything subsequently loaded by it, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-17093 IBM--Power Systems Firmware Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 - OP940.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the BMC/FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-17100 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.1 CVE-2026-17429 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.2 CVE-2026-17494 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.3 CVE-2026-18848 IBM--Power Systems Firmware Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system. 2026-08-19 8.2 CVE-2026-19234 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can cause the ASMI web server to crash with possible memory corruption and generate an error log; hosted partitions are not affected. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact. 2026-08-19 7.6 CVE-2026-16828 IBM--Power Systems Firmware IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention - clearing NVRAM via the service processor - to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system. 2026-08-19 7.3 CVE-2026-17042 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and availability impact. 2026-08-19 7.9 CVE-2026-17063 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-16661 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-16707 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system. 2026-08-19 8.4 CVE-2026-17091 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure boot is not enabled, which is the default configuration, the attacker can also substitute the boot image, compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.1 CVE-2026-17414 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system. 2026-08-19 7.3 CVE-2026-17097 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 7.5 CVE-2026-18821 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system. 2026-08-19 7.3 CVE-2026-18871 ICEcoder--ICEcoder ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user. 2026-08-19 9.8 CVE-2026-63722 indilib--indi INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions. 2026-08-17 7.5 CVE-2026-71979 indithemes--IT Residence Subscriber Arbitrary File Upload in IT Residence defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. 2026-08-18 7.5 CVE-2026-66046 libexpat--libexpat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046. 2026-08-20 7.5 CVE-2026-76641 libfuse--sshfs SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files back to the server or write server-controlled content to writable local files, potentially including startup or scheduled-task files. This issue is fixed in version 3.7.6. 2026-08-19 9.3 CVE-2026-47187 libfuse--sshfs SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6. 2026-08-19 7 CVE-2026-48711 libgit2--libgit2 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5. 2026-08-20 7.5 CVE-2026-53587 LibVNC--libvncserver LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue. 2026-08-21 8.8 CVE-2026-50538 liedekef--Events Made Easy The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction. 2026-08-20 7.5 CVE-2026-75963 liftoff-sr--CIPster A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is named e745d9d4a8ca3a13689066983a1269fe1e567674. It is suggested to install a patch to address this issue. 2026-08-20 7.3 CVE-2026-76987 Linuxfabrik--monitoring-plugins linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0. 2026-08-18 7.8 CVE-2026-55426 logto-io--logto Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0. 2026-08-19 7.5 CVE-2026-62317 louislam--dockge Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docker-socket-handler.ts confirm the caller is logged in and that the name is a string, then pass it straight to Stack.getStack, so a name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Disclosure is limited to files named .env or an accepted Compose filename, and deletion requires the target directory to hold a valid Compose file so that docker compose down exits successfully. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication. 2026-08-20 8.8 CVE-2026-73040 lukeseager--WordPress Persistent Login Subscriber SQL Injection in WordPress Persistent Login

Read more »

Metro by T-Mobile Has the iPhone 16e for $99.99, Then Gives You a $100 Mastercard
Metro by T-Mobile has one of the better iPhone deals available right now. Switch an eligible number to Metro and you can pick up Apple's 128GB iPhone 16e for just $99.99, a $500 instant discount from its $599.99 regular price. Even better, Metro will send you a $100 virtual prepaid Mastercard after your third monthly payment, essentially covering the promotional cost of the phone. You'll need to bring your number and activate an eligible plan, which starts at $55 for the first month and $50/month thereafter with AutoPay. The deal is available on up to two lines and isn't available to current T-Mobile customers or anyone who has had Metro service within the past 180 days. Get the iPhone 16e deal at Metro by T-Mobile See the latest iPhone prices and carrier deals on our iPhone Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

B&H Drops 24GB 13-Inch M5 MacBook Air to $1449, Save $150
B&H Photo has dropped the 13-inch M5 MacBook Air with 24GB RAM and a 512GB SSD in Silver to $1449, a $150 discount from its $1599 price. This is an especially interesting MacBook Air deal because it’s the least-expensive current M5 Air configuration with 24GB of unified memory. The Silver model includes the 10-core CPU/10-core GPU M5 chip and 40W Dynamic Power Adapter, and B&H is offering free 2-day shipping to most US addresses. Shop B&H’s current MacBook Air sale, or see today’s prices in our 13-inch MacBook Air Price Tracker.

Read more »

Sunday Sale: Amazon Offers First Discounts on New M6 and M5 Pro Mac minis, Prices Start at $879.99
Amazon has begun discounting Apple's new M6 and M5 Pro Mac minis, offering some of the first savings we've seen on the new 2026 lineup. The entry-level M6 Mac mini with 16GB RAM and a 256GB SSD is down to $879.99, compared to Apple's $899 MSRP. The M6 model with 16GB RAM and a 512GB SSD is also on sale for $1069.99, a savings of about $29 from Apple's $1099 MSRP. Buyers looking for more performance can step up to the M5 Pro Mac mini with 24GB RAM and a 512GB SSD for $1669.99, also about $29 below Apple's $1699 price. The discounts aren't huge yet, but they're notable given how new these Mac minis are. Amazon is currently offering the lowest prices in our tracker on these three configurations, along with fast shipping on available inventory. For the latest prices and deals, see our Mac mini Price Tracker, updated daily.

Read more »

B&H Launches Big MacBook Air Sale: 21 Models Discounted, Prices Start at $1199
B&H has launched a broad MacBook Air sale covering 21 different configurations, with prices starting at just $1199 and discounts reaching as much as $300. The sale includes both 13-inch and 15-inch models, along with upgraded M5 configurations featuring as much as 32GB of unified memory and 2TB of SSD storage. Shop B&H's MacBook Air sale. Some of the more interesting deals aren't necessarily on Apple's standard configurations. B&H is also discounting a number of custom MacBook Air builds with additional memory and storage, including 24GB and 32GB configurations. For example, select 13-inch M5 models with 32GB RAM and a 512GB SSD are available for as little as $1549, while a 32GB/2TB configuration has dropped to $2349. On the 15-inch side, B&H has select 16GB/1TB M5 configurations starting at $1599, while 24GB/1TB models start at $1799. There's also a remaining 15-inch M4 MacBook Air with 16GB RAM and a 1TB SSD for $1499, which B&H lists as a $300 savings from its regular price. Many of these models are listed as limited supply at the current prices, and B&H is offering free 2-day shipping on most available configurations. Payboo cardholders may also be eligible for B&H's Save the Tax benefit. For the latest MacBook Air prices and deals, visit our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Drops Space Gray 13″ M4 iPad Air 512GB Cellular to $1249.97
Amazon has a new 30-day low price on one specific 13-inch M4 iPad Air configuration: the Space Gray 512GB Wi-Fi + Cellular model is currently $1249.97. That’s $149 off Apple’s current $1399 price, and the discount appears to apply to the Space Gray model only. Other colors may be priced higher, so be sure to select Space Gray before checking out. Check Amazon’s current price, or compare prices in our iPad Air Price Tracker.

Read more »

Amazon has Apple’s 16-inch M5 Pro MacBook Pros on sale for up to $300 off MSRP
Amazon is offering solid discounts on two of Apple's standard 16-inch M5 Pro MacBook Pro configurations. The 24GB RAM/1TB SSD model is currently $240 below Apple's MSRP at $2759.99, while the upgraded 48GB RAM/1TB SSD version is discounted by $300 to $3299. Shop the 24GB model or shop the 48GB model at Amazon. Both Space Black and Silver models are available at the same sale prices, giving buyers the flexibility to choose their preferred finish without paying a premium. These are currently among the best prices available on Apple's standard 16-inch M5 Pro lineup. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on a new MacBook Pro while the discounts remain available. For the latest prices, availability, and deals, visit our 16" MacBook Pro Price Tracker, updated daily.

Read more »