For all Mankind spinoff series Star City premieres on Apple TV
Just as For All Mankind wrapped its latest season on Apple TV, the platform also premiered the first two episodes of Star City, a spinoff set in the same alternate timeline where the Soviet Union beats the United States to the Moon. Watch the trailer below. more…

Read more »

∞ The Dalrymple Report: Apple Watch, AI, and Stolen iPhones
In an article for Bloomberg, Mark Gurman makes the case for an Apple Watch reboot. He's certainly not wrong, the Apple Watch has been stagnant for years now. Some keen people have found a new URL in the updated code pointing to a new subdomain genai.apple.com. Nothing happens when you click on it, but I'm sure after WWDC, we'll get to see exactly what it's for. People have been stealing iPhones since they first came out, but in London, the thieves are also starting to text threats to family members. Follow this podcast Show Notes: Gurman: Apple Watch needs reboot Amazon’s Bee wearable Snap Specs True AR Glasses Reportedly Launch This Fall For Around $2500 Their Phones Were Stolen in London. Then the Threats Started Apple Developing iPhone Anti-Snatching Feature That Locks Stolen Phones Instantly What your browser reveals about you Shows and movies we're watching Marshalls, Paramount+ Marty, Life is Short, Netflix Seven Samurai, HBO

Read more »

Amazon won’t let 13 older Kindle models access new books
Last month Amazon announced that it was cutting off Kindle Store access to 13 older Kindle models, and now that change has officially been implemented. Here’s what that means. more…

Read more »

iPhone 18 Pro color options leak: Dark Cherry steals the spotlight
Apple's iPhone 18 Pro lineup is starting to take shape, and the color game looks bolder than ever. Today, prominent leaker Sonny Dickson… The post appeared first on MacDailyNews.

Read more »

iOS 27 might convince a lot of people to upgrade to a new iPhone
iOS 27 will be unveiled in just over a week, and rumors indicate there are lots of reasons why the new software might push more people than usual to upgrade to a new iPhone. more…

Read more »

Clear your desk with half-off Anker’s clever 3-in-1 Apple Charging Cube
Macworld Anker 3-in-1 MagSafe Charging Cube View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); If you hate a crowded desk, but also need to charge about a million gadgets all at once, Anker’s 3-in-1 MagSafe Charging Cube is what you’re missing. Not only is this a stellar way to recharge your iPhone, Apple Watch, and AirPods, but today only, it’s also half off at Woot, bringing the price down to $65, the best we’ve ever seen. This compact cube will take up very little space on your desk and even less when you’re not actually using it. It features a foldable 15W MagSafe charging pad for your iPhone that can be adjusted up to 60 degrees, thus making it easy to prop your phone in landscape or portrait mode while charging so you can continue browsing or streaming content. Then, your Apple Watch will get charged on a floating accessory, while your AirPods charge is below the iPhone pad. Attach them all, and they’ll be juiced up before your next meeting is over. The cube-shaped triple charger comes with a 30W USB-C charger in the box, as well as a cable, so you won’t need any other accessories to make this work for your home. So go grab this Anker 3-in-1 MagSafe wireless Charging Cube for just $65 and never worry about cable clutter again.

Read more »

Apple doubles down on on-device AI in privacy and security masterstroke that sets it apart from cloud-dependent rivals
Apple is preparing to renew its aggressive push for AI that runs primarily on devices rather than in the cloud—leveraging its years of custom… The post appeared first on MacDailyNews.

Read more »

New leak confirms new iPhone 18 Pro Dark Cherry, Light Blue colors
Macworld About a month ago, Macworld published an exclusive report detailing the upcoming color palette for the iPhone 18 Pro.  As our source confirmed, Apple was planning to offer a new array of options this year, with a purplish “Dark Cherry” leading the pack and possibly four options joining the lineup, including light blue, dark gray, and silver. Now, courtesy of Sonny Dickson on X, we have our first look at iPhone 18 Pro dummy models, and lo and behold, they are in the same four colors. As you can see in the images he supplied, the colors match perfectly with the Pantone codes we were supplied and almost certainly confirm that Apple will offer these options in the fall. Sonny Dickson/X As we described, the Dark Cherry color is closer to purple than red, while light blue is reminiscent of Sierra Blue on the iPhone 13 Pro. Dark gray, meanwhile, appears to be very close to Black Titanium seen on the iPhone 16 Pro. Finally, the standard silver color appears to be very similar to the iPhone 17 Pro. It’s worth noting that Apple seemingly dropped a fourth color option from last year’s lineup later in the production cycle, so it’s possible that one of these four options doesn’t appear on shelves. Of note, the images Dickson supplies have the same design as the iPhone 17 Pro with some subtle improvements. Most notably, the rectangular glass below the camera more closely matches the color of the aluminum surrounding it. And it appears to be a little higher than it is on the 17 Pro. Apple is expected to unveil the iPhone 18 Pro at an event in September alongside the iPhone Ultra, Apple’s first folding phone.

Read more »

iPhone leaks, Apple Vision Pro gaming, and the Ferrari Luce, on the AppleInsider Podcast
You thought the Apple Vision Pro was expensive, but now you could choose between buying 180 of the headset, or one Ferrari Luce designed by Jony Ive. Or you could just enjoy the good, the bad, and the sometimes silly iPhone rumors that came out this week, on the AppleInsider Podcast.Some iPhone 18 leaks are good, some are bad, and others are just silly.It is the run-up to WWDC and it's also not really that long until the launch of the iPhone 18 range, so as always we're now bombarded with rumors and leaks. Some of them are actually likely, though, and some of them look rather good.Here's how to sort out the good leaks from the poor or even the downright silly. Plus forget leaks, there's news for gamers on Apple Vision Pro and it's something you can play right now. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Best Mac gaming setups: From casual console companions to full-on battle stations
Our top 15 best Mac gaming setups from the Cult of Mac archive track the rise of Apple silicon alongside great hybrid Mac-PC systems. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

iPhone 18 Pro dummy units reveal four color options [Gallery]
A new set of iPhone 18 Pro dummy units is giving us our best look yet at the all-new colors Apple has planned for this year. The dummy units corroborate that the iPhone 18 Pro will be available in dark cherry, black, silver, and light blue. more…

Read more »

Suppliers are racing to keep up with orders for incredibly popular MacBook Neo
Amid ongoing MacBook Neo shortages, Apple has reportedly tasked suppliers with doubling its original order to 10 million units in an attempt to satiate demand.MacBook Neo has proven hugely popularBuying a new MacBook Neo today remains an exercise in patience, with deliveries taking multiple weeks. The 13-inch, $599 laptop has proven hugely popular among students and mobile workers alike, so much so that Apple can't keep up.Now, a report by supply chain analyst Ming-Chi Kuo claims that Apple has told its suppliers to produce more MacBook Neos than ever before. After an initial five-million-unit order, Apple has now doubled the figure to 10 million units. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

The last visionOS 26 review: Apathy about Apple Vision Pro on display
Apple Vision Pro isn't a priority product for Apple's teams, and it shows in the development of visionOS 26. Bug fixes, minor adjustments, and nearly zero feature additions define the year.visionOS 26 review: it hasn't been touched in a year which means WWDC better deliverWhen visionOS 26 was revealed, it was clear that new hardware would be crucial for the platform. Then the M5 model arrived, and it was better, but nothing else changed in the time since.I'm sitting here typing this on the Apple Vision Pro connected to a Bluetooth mechanical keyboard and Apple Magic Trackpad. It's been over two years since I used the original model, and yet, it still feels magical. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple's software chief: Who is Craig Federighi?
As the Senior Vice President of Software Engineering, Craig Federighi is the main guy who can alter the future of iOS, macOS, and AI for Apple. This is what you need to know about the guy with the fantastic hair.Craig Federighi - Image Credit: AppleWhile Tim Cook is the best-known face of Apple, Craig Federighi comes in a very close second. A long-time presenter for the company during events, especially at WWDC, he is synonymous with the company's software launches and operating system updates.That's handy, since he is Apple's Senior Vice President of Software Engineering. In that prominent role, he manages and guides the development of operating systems, apps, interface changes, and future technologies. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iPhone 18 Pro dummies show new colors, including Dark Cherry
Images of purported iPhone 18 Pro dummies back up previous claims that Cosmic Orange is out, and Dark Cherry is in.The four colors now claimed to be for the iPhone 18 Pro - image credit: Sonny DicksonCosmic Orange was a huge hit with Apple's iPhone 17 Pro Max, but Apple changes at least some colors each year and it's long been rumored that Dark Cherry was coming next. Then in April 2026, a leaker claimed to know all four of the colors for the iPhone 18 Pro.Now the often reliable leaker Sonny Dickson has shared images of dummy iPhones featuring those same four colors: Continue Reading on AppleInsider | Discuss on our Forums

Read more »

5 easy tweaks to turn your distracting Apple Watch into a quiet fitness tracker
Macworld I love my Apple Watch, and I know I’m not alone—the device dominates the wearables market and is easily the best smartwatch money can buy. But that doesn’t mean it’s perfect, and there are plenty of ways that it can feel below par, even irritating at times. Few of those factors are more conspicuous than the way it can sometimes serve as a wrist-worn distraction tool. With the rise of screenless, silent trackers like the Whoop and Fitbit Air, the Apple Watch’s tendency to buzz and bleep all day can be overwhelming.  If you’re sick of getting constantly pinged by your Apple Watch, I’ve got good news: there are a plethora of ways you can rein in the worst excesses of watchOS and turn your device into a calmer, quieter tracker. Just follow the steps in this guide and relief will be close at hand. Turn on Silent Mode When you want to mute everything in a quick, simple way, switch on your Watch’s Silent Mode so there will no longer be an audible sound when you get a notification. This is something of a nuclear option, but it guarantees a peaceful watch experience. To get started, press the Watch’s side button to open Control Center, then tap the bell button. The button will turn red and a line will be drawn through it to indicate that alerts are muted. Britta O’Boyle Note that this does not turn off haptic vibrations. To do that, open the Settings app on your Apple Watch, then scroll down and go to Sounds & Haptics > Haptics. Tap Off. For a less dramatic change, you can reduce alert volume. For this, you’ll need to return to the Sounds & Haptics section of your Watch’s Settings app. Select Level from the list of options, then tap Quieter. Use Focus modes Focus modes are a more tailored way to keep notifications in check. They can block certain alerts at certain times and have a wide array of customizable options. First, press the side button to open your Apple Watch’s Control Center. Tap the Focus button (it looks like a crescent moon), select a Focus mode, then set how long you want it to be in effect for. The options here are based on the Focus modes created on your iPhone. Any custom Focus modes you create on your iPhone (by going to Settings > Focus) can be used on your Apple Watch. Foundry When you enable a Focus mode on your Watch, it is automatically enabled on your iPhone too (and vice versa). If you want it to be applied to all of your Apple devices, open the Settings app on your iPhone and go to Focus, then switch on Share Across Devices. You can go further by adding a Focus watch face. This sets a different face on your Watch whenever a specific Focus mode is active. That’s handy if you want a less distracting watch face while Do Not Disturb is running, for example. On your iPhone, open the Settings app and go to Focus, then tap a Focus mode. Under Customize Screens, tap Choose under the Apple Watch face. Pick a watch face from the list of options, then tap the checkmark. Now, whenever you enable this Focus mode, your Watch face will change. Focus modes can also be scheduled. On your Apple Watch, open the Settings app and go to Focus, tap a Focus mode, then choose Add New. Pick start and end times under From and To, then select which days the schedule will be active. Tap the back button to save your schedule. Or you can grab your iPhone and go to Settings > Focus, pick a Focus mode, then tap Add Schedule. Tame your notifications When you get a notification on your Apple Watch, you can swipe left on it to see options to mute it. You can mute it for one hour or for the rest of the day. Tapping Add to Summary will send future alerts from the app to your iPhone’s Notification Summary instead of immediately buzzing your wrist. Time-sensitive alerts can also be disabled from this menu, or you can switch off the app’s notifications entirely. Chris Martin / Foundry Alternatively, you can control notifications for all your Apple Watch apps in one place. Open the Watch app on your iPhone and go to My Watch > Notifications. Scroll down to Mirror iPhone Alerts From and disable the toggle next to any apps whose notifications you no longer want to see on your wrist. Or if you’d rather simply get more control over app notifications, scroll up to the list of apps above the Mirror iPhone Alerts From section, tap one, then adjust its settings as needed. Some apps let you set your own notification rules. On an app’s page, scroll down to Notification Settings, then tap Custom. Tap Notifications Off if you want to disable all alerts for that app. Cull the apps you don’t need If an app is on your Watch and you haven’t changed its notification settings, it can send you alerts. The more apps you’ve are installed, the more notifications you end up getting, which can be a problem. Chris Martin / Foundry A simple way to fix this is to remove apps you don’t use on your Watch. Press the Digital Crown to see the list of apps installed on your Apple Watch. Press and hold an empty area of the display until the apps start to jiggle. Tap the X button on an app you want to remove, then tap Delete App. Another option is to install apps manually rather than have them automatically transfer across from your iPhone. To do this, open the Watch app on your iPhone and tap General, then disable the toggle next to Automatic App Install. Prevent watch face takeovers Some apps automatically take over your entire watch face when they’re active. While this can be useful at time—such as when you use Apple Maps for directions—other times it can be overly distracting. One way to limit this is to turn off Live Activities. Open the Settings app on your Watch and go to General > Auto-Launch > Live Activities Settings. For a quick fix, turn off the toggle next to Auto-Launch Live Activities. This will keep Live Activities as an option, but it will prevent them from starting by themselves. Chris Martin / Foundry Alternatively, you can disable Live Activities completely by switching off the toggle next to Allow Live Activities. Sometimes, you might also find that Siri has partially obscured the clock when you lift your wrist to check the time. This is due to Siri’s Raise to Wake feature mistaking random conversation for a voice command. This can be turned off by opening the Settings app on your Watch, then tapping Siri and disabling Raise to Speak. With that, you should get a clearer, less obstructed view of your watch face, keeping you on track and less distracted whenever you glance at your Apple Watch.

Read more »

WWDC 2026: The year of the do-over
Macworld Every year at WWDC, Apple kicks off a new cycle of operating system updates that will change the faces of the devices we use every day for the next year. On June 8, we’ll get our first glimpse at what the “27” operating systems will bring, which will lead to their arrival in the fall and numerous major updates all the way through next May, when the cycle will begin again. I’ve been attending Apple’s WWDC since sometime in the 1990s, which is… a long time. But this year’s event promises to be one of the most interesting ones yet, mostly because in 2024, Apple really stepped in it, promising a bunch of features it didn’t deliver. Last year was a bit of an apology tour, but it didn’t directly address what had been promised previously. Which means that Apple has really piled two years of promises on the agenda of WWDC 2026. The stakes couldn’t be higher. Here’s what I’ll be watching for at this year’s event, especially when it comes to its AI do-over. Time to deliver In 2025, Apple didn’t make a single promise at WWDC in June that it failed to deliver by the end of the year. That was by design, as a way to begin to repair the trust that was breached when it got out too far over its skis in 2024. It was a good start, but AI was also largely absent from the promise list last year. This year, Apple needs to deliver on what it failed to deliver in 2024. It needs to deliver the coherent AI strategy it ended up punting two years ago. It’s time to renew the vows it made in 2024 and provide a comprehensive approach to AI features on Apple platforms that it can actually begin executing in 2026. The tricky thing is that Apple will need to thread the needle between what’s possible and pragmatic and what goes a bit too far. If it gets too conservative with its promises, it risks seeming dowdy and behind the times. But if it goes too wild with promises, it risks a repeat of 2024, where it couldn’t execute at the level it had assumed it could. What’s the right balance between those two extremes? Apple doesn’t want to be seen as being behind, but it also doesn’t want to seem desperate in trying to keep up with the cool kids–especially since the power and success of the iPhone means that it doesn’t have to. (All the major AI platforms are popular on iOS, which helps a lot.) I think it’s more likely that Apple is still overcorrecting from 2024 and will be restrained in what it announces this year, which means I’m bracing for disappointment. What I hope will happen is that Apple will sketch out its broader vision for how AI fits in with its platforms–including some foundational technologies like App Intents and Siri–even if it has to admit that it’s going to take longer than six months to get there. Last year’s WWDC focused on products and features that Apple could deliver in a timely fashion.Foundry Apple hates giving road maps, hates talking about general directions rather than specific features that it can ship, but I think it’s required here. It should sell us on its vision for how AI fits in with what it’s doing, and then can give some near-term examples of how it’s starting to execute on that front. I don’t think anyone reasonable feels Apple needs to solve everything about AI in iOS 27.0–but feeling like the company knows where it’s going and knows how to get there would sure help. Don’t let your standards slip Much has been made of Apple’s broken promises in 2024, but there’s another sin of the past the company should not repeat: lowering its own standards in order to get features out the door. Forget about the AI features that didn’t ship in 2024. The ones that did were not very good! They showed all the signs of being slapped together in a rush in order to get something out the door. Let me give you one example: Writing Tools. AI large-language models excel at writing and rewriting text–it’s how they got started. Integrating those text tools into Apple’s platforms seemed like basic table stakes. But what Apple shipped wasn’t integrated. Its operating systems have been checking your spelling and providing other editing tools for ages. Writing Tools wasn’t thoughtfully integrated into the larger text-editing package–it was like a sidecar bolted on to the side, completely separate, with a weird, off-putting interface. Writing Tools was one of the first AI-based features. But it felt like it was bolted on and not fully integrated into the OS.Foundry What has always set Apple apart from the competition is a thoughtful application of high technology in ways that solve problems for users. Writing Tools does solve some problems, but I wouldn’t call its application thoughtful. What I want to see in 2026 is a set of AI features that Apple has really thought through and that fit with the iOS and macOS experience. Features that carry the unmistakable smell of panic and fear are a red flag. Focus on the practical You can’t escape the marketing of AI features, but most of that marketing struggles to come up with good, realistic examples of why you’d use those features. (This is a side effect of the features coming first, and the use cases second, which is not how you should ever develop a product.) Apple, to its credit, has proven very good at coming up with examples. All of those Apple Intelligence ads that it got sued over because the features never shipped? At least they were based on useful examples! Apple needs to provide practical examples of how the new AI features are useful.Apple So during the WWDC keynote, what I want to see are practical demonstrations of Apple’s features. I don’t need Apple to prove that it’s chasing cutting-edge AI features; I want it to solve the problems of iPhone users. I want it to show AI tools fixing things that Apple’s customers want to have fixed. And if I see another demo where someone points a camera at a refrigerator and asks for a recipe with the visible ingredients, someone is getting sent to the principal’s office. New leaders with a new attitude In the last two years, Apple has gotten rid of the people in charge of its AI strategy. There are new bosses now, and of course, John Ternus is about to become the new CEO. New leadership gives organizations an opportunity to turn the page and do things differently. Even if the new leaders are longtime employees (which is almost always the case at Apple), they’re in new roles, and they have the opportunity to put their own stamp on things. John Ternus doesn’t officially become Apple’s CEO until September, but his presence looms large at WWDC this year.Apple I want to see that. I want to get the sense that in the last two years, Apple has really rethought how it approaches AI. What does Siri mean now, compared to what it’s meant the last 14 years? Is it the core brand, or is that Apple Intelligence? How do apps function in an increasingly AI-driven world? Sure, new hardware if you have it The top rookie mistake of WWDC anticipation is expecting there to be hardware. This isn’t a hardware event; it’s an operating-system announcement and developer event. That said, sometimes hardware does appear at WWDC. It doesn’t have to, but it could. The Mac Studio and Mac mini both have pretty favorable developer-related narratives, what with the high-end power of the Studio and the fact that the Mac mini has become a darling gadget of AI agent tinkering. Neither product has been updated to M5 yet. This would seem like a decent time, actually, to announce some hardware! But given all the chip shortages out there, I get the feeling that Apple might not really want to create more demand for M5 chips and RAM when it doesn’t need to. Still, if you want to hold out hope for a hardware announcement, I’m not going to stomp on your dreams. Want to learn more about Apple’s Worldwide Developers Conference? Read the Macworld WWDC superguide and check out the full coverage of WWDC.

Read more »

Get Apple power, Retina display, and 1TB storage with a near-mint MacBook Pro refurb for $430
Macworld TL;DR: Grab a refurbished 2020 MacBook Pro for just $429.97 (reg. $1,999) through June 14 and score a powerful 13-inch laptop for a fraction of the usual price. Sale ends June 14. Finding a solid laptop at a reasonable price isn’t easy right now, especially with newer models pushing costs even higher. This deal, available through June 14, brings back some sanity with a 2020 MacBook Pro in near-mint condition for $429.97, down from its original $1,999 price, making it a strong upgrade option if you need performance without overspending. Inside, you’re getting a 10th Gen Intel Core i5 quad-core processor paired with 16GB of RAM and a 1TB SSD, giving you smooth performance for multitasking, large files, and everyday work without constant slowdowns. It’s a setup built to stay responsive even when you’ve got multiple apps and tabs running at once. 13.3-inch Retina display with 2560×1600 resolution for sharp, detailed visuals True Tone technology that automatically adjusts color balance to your lighting Intel Iris Plus graphics for streaming, light creative work, and general use Backlit Magic Keyboard for comfortable typing in low-light settings Touch Bar for quick shortcuts and streamlined controls Touch ID for fast, secure fingerprint login You also get four Thunderbolt 3 (USB-C) ports for charging, external displays, and fast data transfer, plus Wi-Fi 5 and Bluetooth 5.0 for reliable wireless connectivity with modern devices. This grade-A refurbished unit should arrive in near-mint condition, with only minor signs of use. It weighs about 3.1 pounds, comes with a charger, and includes a limited third-party warranty. Get this MacBook Pro refurb while it’s on sale for $429.97 through June 14. Apple MacBook Pro (2020) 13″ i5 2GHz Touchbar 16GB RAM 1TB SSD Space Gray (Refurbished)See Deal StackSocial prices subject to change.

Read more »

Apple’s next-gen Siri could rely heavily on local AI
Next-gen Siri will use a smaller on-device Google Gemini model to answer common queries for a better experience. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

How to turn Jellyfin on an old Mac into a private streaming service
Film fans with a massive movie collection can make their own mini Netflix by using Jellyfin and a Mac as a file server. Here's how to create your own home video streaming service.Jellyfin is a media server tool. Streaming services like Netflix, Disney+, and Apple TV+ are great ways to watch movies and TV shows without needing to actually own the physical media. However, if you already have a copy of a movie on DVD or Blu-ray, the only real benefit to watching it via an Internet streaming service is convenience.If you have a sizable movie collection that you regularly go through, the last thing you want is to pay tens of dollars per month for the privilege of not having to switch discs in a Blu-ray player or a game console. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

John Travolta’s directorial debut is now available to stream on Apple TV
Apple TV subscribers can now watch Propeller One-Way Night Coach, a film that not only marks John Travolta’s directorial debut, but was adapted by the actor from a children’s novel he wrote in 1997. Watch the trailer below. more…

Read more »

Apple's latest conflict mineral report contradicts previous complaints over their use
Despite many claiming otherwise, Apple says your iPhone and iPad don't contain conflict minerals sourced from armed groups in Africa.Apple says it doesn't use conflict mineralsWhile Apple remains proud of its supply chain and environmental efforts, the company has faced continued scrutiny regarding the materials it uses to make its products. With 2024 legal complaints, protests over the iPhone 16 launch, and even a 2025 lawsuit, Apple has often been accused of using conflict minerals.In 2018, 2019 and 2022, Apple cut ties with suppliers who sourced conflict minerals, effectively suggesting that all the tin, tantalum, tungsten, and gold found in its products did not come from armed groups. In a filing with the Securities and Exchange Commission on Thursday, Apple reiterated its stance. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple Watch sleep data helps Harvard researchers study menopause transition
Researchers at Harvard have published the results of a study that analyzed more than 94,000 nights of Apple Watch sleep data to better understand how sleep patterns change during perimenopause. Here are the details. more…

Read more »

9to5Mac Daily: May 28, 2026 – iOS 27 leak, Oura Ring 5
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by CardPointers: The best way to maximize your credit card rewards. 9to5Mac Daily listeners can exclusively save 30% and get a $100 Savings Card. more…

Read more »

Apple says latest conflict minerals review found no basis to link suppliers to armed groups
Apple has filed its annual conflict minerals disclosure with the SEC, detailing its supply chain checks across iPhone, Mac, and more. Here are the details. more…

Read more »

Union workers protest Apple’s planned Towson store closure
The IAM Union held a protest against Apple’s decision to close its Towson store, the first unionized Apple retail location in the United States. Here are the details. more…

Read more »

Apple's AI research will be in a computer vision conference before WWDC
Apple will present 14 AI research papers at the 2026 IEEE/CVF Conference on Computer Vision and Pattern Recognition in Denver next week, spanning image generation, spatial understanding, and multimodal reasoning.Apple's AI research will be presented at an annual computer vision conference in Denver.The company continues to explore the applications of AI and large language models, with studies detailing their use in image generation, UI prototyping, QE testing, and much more. Apple's researchers have also examined the role of artificial intelligence in spatial understanding, with ideas that iOS 27 Accessibility features will bring to reality.Some of the studies AppleInsider has previously detailed, including one on AI-powered sign language annotation, will be presented at the annual IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). The Apple-sponsored event will take place from June 3 through June 7 at the Colorado Convention Center in Denver. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple TV’s ‘Widow’s Bay’ is the best new show on TV; it’s a genuine miracle – Slate
“Widow’s Bay” is a quaint island town 40 miles off the coast of New England. But something lurks beneath the surface. Mayor Tom Loftis… The post appeared first on MacDailyNews.

Read more »

Age of Empires II: Definitive Edition now available for macOS
Following the announcement that Age of Empires II: Definitive Edition would soon be coming to Mac gamers for the first time, the game is now available. Here are the details. more…

Read more »

iOS 27 changes visualized for the first time, new Apple Watch details, AirDrop reliability
Benjamin and Chance discuss the illustrations Bloomberg published depicting iOS 27 and the new Siri interface. Also, we talk about rumors of a revamped AirPods settings UI, phone snatching detection in iOS 26.6 code, and Digitimes says the Apple Watch Ultra 4 will feature a significant redesign. Also, has AirDrop got worse? And in Happy Hour Plus, Apple showcases the iPhone 17 Pro by producing and broadcasting the first full live sports game using ‘just’ iPhones. Subscribe at 9to5mac.com/join. Sponsored by Bartender: Bartender Pro is a new option for users who want to take things up a notch. Visit macbartender.com/happyhour to check it out. Sponsored by Copilot Money: Get two months free with code 9TO5MAC at copilot.money/9to5mac. Sponsored by Shopify: See less carts go abandoned and more sales. Sign up for a $1 per month trial at shopify.com/happyhour. more…

Read more »

Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a frequent staging ground for cyber mischief from Russia's intelligence agencies.

Read more »

Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Read more »

Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States.

Read more »

CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

Read more »

Patch Tuesday, May 2026 Edition
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers -- including Apple, Google, Microsoft, Mozilla and Oracle -- fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.

Read more »

Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.

Read more »

Vulnerability Summary for the Week of April 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info n/a-- OVMS3 3.3.005 Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. 2026-05-01 10 CVE-2026-37541 https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  tendacn[.]com-- W308R Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25316 ExploitDB-44373VulnCheck Advisory: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change  tendacn[.]com--W3002R Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers. 2026-04-29 9.8 CVE-2018-25317 ExploitDB-44380VulnCheck Advisory: Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change  tendacn[.]com--FH303/A300 Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25318 ExploitDB-44381VulnCheck Advisory: Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change  Weaver Network Co., Ltd.--E-office Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC). 2026-04-30 9.8 CVE-2022-50993 https://service.e-office.cn/knowledge/detail/5https://cn-sec.com/archives/1453025.htmlhttps://bbs.chaitin.cn/topic/37https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet  synway[.]net-- SMG Gateway Management Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC). 2026-04-30 9.8 CVE-2025-71284 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yamlhttps://mrxn.net/jswz/synway-9-2radius-rce.htmlhttps://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsAhttps://www.synway.net/https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address  Directorist Booking--Directorist Booking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2. 2026-04-27 9.3 CVE-2026-22336 https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve  Directorist--Directorist Social Login Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4. 2026-04-27 9.8 CVE-2026-22337 https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve  Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. 2026-04-27 9.8 CVE-2026-32644 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  n/a--Automotive Grade Linux (AGL) AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently. 2026-05-01 9.8 CVE-2026-37531 https://gerrit.automotivelinux.org/gerrit/src/app-framework-mainhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a-- cannelloni v2.0.0 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. 2026-05-01 9.8 CVE-2026-37539 https://github.com/mguentner/cannellonihttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  Carlson Software--VASCO-B GNSS Receiver The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials. 2026-04-28 9.4 CVE-2026-3893 https://www.carlsonsw.com/support-and-training/https://www.cve.org/CVERecord?id=CVE-2026-3893https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json  Mersenne--Prime95 Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands. 2026-04-29 8.4 CVE-2018-25299 ExploitDB-44649Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH  xataboost--XATABoost CMS XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information. 2026-04-29 8.2 CVE-2018-25300 ExploitDB-44622Official Product HomepageVulnCheck Advisory: XATABoost CMS 1.0.0 SQL Injection via news.php  Easy MPEG--Easy MPEG to DVD Burner Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe. 2026-04-29 8.4 CVE-2018-25301 ExploitDB-44565Product ReferenceVulnCheck Advisory: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow  Alloksoft--Allok Video to DVD Burner Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution. 2026-04-29 8.4 CVE-2018-25303 ExploitDB-44518Official Product HomepageVulnCheck Advisory: Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH  Filehippo--Free Download Manager Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code. 2026-04-29 8.4 CVE-2018-25304 ExploitDB-44499Product ReferenceVulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH  Sysgauge--SysGauge Pro SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges. 2026-04-29 8.4 CVE-2018-25307 ExploitDB-44455VulnCheck Advisory: SysGauge Pro 4.6.12 Local Buffer Overflow SEH  donmik--Buddypress Xprofile Custom Fields Type BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. 2026-04-29 8.8 CVE-2018-25308 ExploitDB-44432Official Product HomepageVulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution  Alloksoft--WMV to AVI MPEG DVD WMV Converter Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious input containing shellcode with structured exception handler (SEH) overwrite to bypass protections and execute code with application privileges. 2026-04-29 8.4 CVE-2018-25314 ExploitDB-44365Official Product HomepageProduct ReferenceVulnCheck Advisory: Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow  Alloksoft--Video Joiner Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with structured exception handler (SEH) overwrite and shellcode to achieve code execution when the application processes the license registration input. 2026-04-29 8.4 CVE-2018-25315 ExploitDB-44364Official Product HomepageProduct ReferenceVulnCheck Advisory: Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name  marketingfire--Widget Options Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0. 2026-05-02 8.8 CVE-2026-2052 https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cvehttps://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534https://plugins.trac.wordpress.org/changeset/3481338/https://plugins.trac.wordpress.org/changeset/3514411/  Milesight--MS-Cxx63-PD An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. 2026-04-27 8.8 CVE-2026-20766 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  wclovers--WCFM Frontend Manager for WooCommerce The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. 2026-05-02 8.1 CVE-2026-2554 https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cvehttps://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386https://plugins.trac.wordpress.org/changeset/3483695/  opencats--OpenCATS OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete. 2026-04-28 8.1 CVE-2026-27760 https://chocapikk.com/posts/2026/opencats-installer-rce/https://github.com/opencats/OpenCATS/pull/706https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint  Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. 2026-04-27 8.8 CVE-2026-27785 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  Cockpit--Cockpit CMS Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server. 2026-04-29 8.8 CVE-2026-34965 https://github.com/agentejo/cockpithttps://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections  n/a--(UDS) & OBD-II (On Board Diagnostics for Vehicles) miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. 2026-05-01 8.8 CVE-2026-37536 https://github.com/miaofng/uds-chttps://github.com/openxc/uds-chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a--Open-SAE-J1939 (Daniel Martensson) collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt- >data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. 2026-05-01 8.1 CVE-2026-37537 https://github.com/DanielMartensson/Open-SAE-J1939https://github.com/collin80/Open-SAE-J1939https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  openampproject[.]org--OpenAMP v2025.10.0 OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. 2026-05-01 8.4 CVE-2026-37540 https://github.com/OpenAMP/open-amphttps://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a--MixPHP Framework 2.x Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to OpisClosureunserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution. 2026-05-01 8.4 CVE-2026-37552 https://github.com/mix-php/mixhttps://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phphttps://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975  benjaminprojas--WP Editor The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. 2026-05-01 8.8 CVE-2026-3772 https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cvehttps://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103https://plugins.trac.wordpress.org/changeset/3480577/  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0. 2026-04-30 8.1 CVE-2026-40600 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xmhttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  TRENDnet--TEW-821DAP A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer. 2026-05-02 8.8 CVE-2026-7607 VDB-360564 | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowVDB-360564 | CTI Indicators (IOB, IOC, IOA)Submit #806214 | Trendnet TEW-821DAP v1.12B01 CWE-120 Buffer Copy without Checking Size of Inputhttps://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_BO.md  carazo--Import and export users and customers The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page. 2026-05-02 8.8 CVE-2026-7641 https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cvehttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21https://plugins.trac.wordpress.org/changeset/3515646  Cozmoslabs--Profile Builder Pro The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory. 2026-05-02 8.1 CVE-2026-7647 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L13https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L13  Shenzhen Libituo Technology--LBT-T300-HW1 A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 8.8 CVE-2026-7674 VDB-360827 | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowVDB-360827 | CTI Indicators (IOB, IOC, IOA)Submit #800705 | Libtor Technology lbt-t300-hw1 closure, xreq). The NULL propagation chain through afb-context.c:110 (context- >credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context- >credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14. 2026-05-01 7.8 CVE-2026-37525 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) afb-daemon v19.90.0 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29. 2026-05-01 7.8 CVE-2026-37526 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) aglservice v17.1.12 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer. 2026-05-01 7.1 CVE-2026-37532 https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-levelhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) isotp-c openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information. 2026-05-01 7.1 CVE-2026-37535 https://github.com/openxc/isotp-chttps://github.com/openxc/isotp-c/blob/master/src/isotp/receive.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a-- Vanetza V2X v26.02 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver. 2026-05-01 7.5 CVE-2026-37554 https://github.com/riebl/vanetzahttps://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpphttps://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpphttps://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40595 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4060 https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1767https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1785https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40601 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-cpr6-mhgm-893whttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb- >prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings. 2026-05-02 7.5 CVE-2026-4061 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1748https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Hooks/SearchResults.php#L39https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Search.php#L152https://plugins.trac.wordpress.org/changeset/3503627/  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context - `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4062 https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/  n/a--libssh2 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. 2026-05-01 7.3 CVE-2026-7598 VDB-360555 | libssh2 userauth.c userauth_password integer overflowVDB-360555 | CTI Indicators (IOB, IOC, IOA)Submit #805564 | libssh2 Shell interface, gaining root-level access to the device. 2026-04-29 4.3 CVE-2018-25310 ExploitDB-44387Vulnerability AdvisoryVulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution  gnu--wget2 wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. 2026-04-29 4.8 CVE-2026-1858 https://www.tenable.com/security/research/tra-2026-37  wazuh--wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4. 2026-04-29 4.4 CVE-2026-26204 https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857https://github.com/wazuh/wazuh/releases/tag/v4.14.4  Oracle Corporation--Oracle Linux An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context. 2026-05-01 4.4 CVE-2026-35233 Oracle Advisory  n/a-- V2Board  v1.7.4 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis. 2026-05-01 4.9 CVE-2026-37505 https://github.com/v2board/v2boardhttps://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9  nextlevelbuilder--ui-ux-pro-max-skill A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet. 2026-05-01 4.3 CVE-2026-7596 VDB-360549 | nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingVDB-360549 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805510 | nextlevelbuilder ui-ux-pro-max-skill 2.5.0 Slide Generator Multiple Stored XSShttps://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/  n/a--Open5GS A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component. 2026-05-02 4.3 CVE-2026-7601 VDB-360558 | Open5GS AMF gmm-handler.c denial of serviceVDB-360558 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805675 | Open5GS v.2.7.6 Denial of Servicehttps://github.com/open5gs/open5gs/issues/4321https://github.com/open5gs/open5gs/commit/ebc66942b6f8f1fab2d640e71cf4e9f1a423b426https://github.com/open5gs/open5gs/releases/tag/v2.7.7https://github.com/open5gs/open5gs/  itsourcecode--Courier Management System A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. 2026-05-02 4.7 CVE-2026-7612 VDB-360569 | itsourcecode Courier Management System edit_user.php sql injectionVDB-360569 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #806275 | itsourcecode Courier Management System V1.0 SQL Injectionhttps://github.com/ltranquility/submit/issues/12https://itsourcecode.com/  ChatGPTNextWeb--NextChat A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-02 4.3 CVE-2026-7643 VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyVDB-360755 | CTI Indicators (IOB, IOC, IOA)Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policyhttps://github.com/ChatGPTNextWeb/NextChat/issues/6756https://github.com/ChatGPTNextWeb/NextChat/  n/a--crmeb_java A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7673 VDB-360826 | crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadVDB-360826 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800684 | crmeb crmeb_java 1.3.4 Unrestricted Uploadhttps://fx4tqqfvdw4.feishu.cn/docx/EgMOdHyq6oyxhux5vpJcr5cgnAf?from=from_copylink  kerwincui--FastBee A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7676 VDB-360829 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalVDB-360829 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800723 | kerwincui FastBee ≤ 1.2.1 Path Traversalhttps://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink  jsbroks--COCO Annotator A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7680 VDB-360833 | jsbroks COCO Annotator Data Endpoint datasets.py path traversalVDB-360833 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #801150 | jsbroks COCO Annotator 0.11.1 Absolute Path Traversalhttps://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter  AMTT--Hotel Broadband Operation System A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7697 VDB-360866 | AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionVDB-360866 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #803272 | Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System v1.0 SQL Injectionhttps://github.com/testnet0/testnet/issues/74  Telegram--Desktop A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7701 VDB-360870 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceVDB-360870 | CTI Indicators (IOB, IOC, IOA)Submit #804341 | Telegram Telegram Desktop

Read more »

Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.

Read more »

Metro Makes Apple’s iPhone 16e Effectively Free — Plus a Free $100 Visa Card
Metro by T-Mobile is now offering one of the more aggressive prepaid iPhone deals currently available, giving switchers Apple’s iPhone 16e effectively for free when they bring over their existing number. Customers pay $99.99 upfront for the 128GB iPhone 16e, then receive a $100 virtual prepaid Mastercard after maintaining qualifying service for three months, offsetting the entire device cost. Metro is also including instant savings at checkout, making this one of the simpler no-trade-in iPhone offers currently available. See this deal on Metro's website. For additional iPhone sales and carrier promotions, visit our iPhone Price Tracker, updated regularly.

Read more »

Amazon Slashes 13″ & 15″ M5 MacBook Air Prices by $200 off Apple MSRP, prices now start at only $899
Amazon has increased its End of Memorial Day discounts on Apple's entry-level M5 MacBook Air lineup, dropping both the 13-inch and 15-inch 16GB/512GB models by $200 below Apple's MSRP. The 13-inch model is now available for about $899, while the larger 15-inch version has fallen to roughly $1099. Shop the 13-inch deal here. These are some of the lowest prices we've seen so far on Apple's newest MacBook Air models, making right now a particularly attractive time to buy. View the 15-inch deal here. For the latest sales and deals, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, updated daily.

Read more »

14″ M5 MacBook Pros on Sale at Amazon & B&H — Up to $200 Off Apple Pricing
Amazon and B&H are both offering discounts on Apple's popular 14-inch M5 MacBook Pro configurations, with the 16GB/1TB model now selling for $200 below MSRP and the 24GB/1TB version discounted by $150. Check current Amazon pricing here. While Amazon offers fast shipping and broad availability, B&H matches many of the same sale prices while adding free 1–2 day shipping to most U.S. addresses. Browse current B&H pricing here. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Memorial Day Sale: 13″ M5 MacBook Airs Return to $150
Amazon has brought back its $150-off pricing on Apple’s 13-inch M5 MacBook Air lineup for Memorial Day weekend, with discounts available across multiple configurations. The popular 16GB/512GB model is once again selling for about $949 instead of Apple’s $1099 MSRP, while higher-capacity models are seeing the same $150 discount. Check current Amazon pricing here. The nice thing about this sale is its consistency—every major 13-inch M5 MacBook Air configuration is discounted by the same amount, making it easy to compare models without worrying about uneven pricing. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

15″ M5 MacBook Airs on sale again for $150 at Amazon — Lowest Prices Yet
Amazon is now offering some of the best pricing yet on Apple’s 15-inch M5 MacBook Air lineup, with $150 discounts across all configurations. The popular 16GB/512GB model has dropped to about $1149 from Apple’s $1299 MSRP, and similar savings are showing up on higher storage and memory options as well. Check current deals at Amazon. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Discounts Space Black 14″ M5 MacBook Pros by Up to $300 Off MSRP
Amazon is now offering some of the best prices we’ve seen so far on Apple’s Space Black 14-inch M5 MacBook Pro lineup, with discounts ranging from $199 to $300 below Apple’s standard MSRP. The base 16GB RAM/1TB SSD model is now down to $1499.99 versus Apple’s $1699 MSRP, while the upgraded 32GB RAM/1TB SSD version has dropped to $1799 compared to Apple’s $2099 MSRP. Check current Amazon pricing here. The middle 24GB RAM/1TB SSD configuration is also discounted to $1749, or $150 below Apple pricing. Together, these are currently among the lowest prices available for Space Black 14″ M5 MacBook Pro models from Apple’s major retailers. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon Cuts Prices on 16″ M5 Pro/Max MacBook Pros — $250 Off MSRP
Amazon is now discounting Apple’s entire 16-inch M5 Pro and M5 Max MacBook Pro lineup by $250 off MSRP, with every listed configuration currently reduced below Apple’s standard pricing. The sale includes both Black and Silver models across the M5 Pro and M5 Max families, with prices starting at $2449.99 for the 24GB/1TB M5 Pro configuration. Check current Amazon pricing here. Higher-end M5 Max models are also seeing the same consistent $250 discounts, including the 36GB/2TB configuration at $3649.99 and the 48GB/2TB version at $4149.99. See these models here. These are currently the lowest prices available among Apple’s major retailers. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Verizon Drops AirPods Pro 3 to $199 — Lowest Price Available Anywhere Right Now
Verizon is currently offering Apple’s AirPods Pro 3 for $199, down from Apple’s standard $249 MSRP. That’s a clean $50 discount (20% off), and right now it appears to be the lowest widely available price from any major Apple retailer. Check current Verizon pricing here. The sale price applies to online orders only, and Verizon also offers free shipping or free local store pickup (if available in your area). Unlike many carrier promotions, Verizon service is not required to purchase the AirPods. For the latest sales and deals, see our AirPods Price Tracker, updated daily.

Read more »

Total Wireless Has One of the Most Aggressive iPhone 17e Deals Right Now
Total Wireless is currently offering one of the more aggressive iPhone 17e deals available right now. Customers signing up for the carrier’s $60/month Total 5G+ Unlimited plan can get the phone for $0 per month over 24 months, effectively covering the full cost of Apple’s $599 MSRP iPhone 17e. Check the current Total Wireless deal here. If you’d rather buy the phone outright, Total is also offering $200 off the full retail price, dropping the iPhone 17e to about $399 with qualifying plans and port-in activation. That combination of upfront savings and financing flexibility makes this one of the stronger prepaid iPhone deals available right now. For the latest sales and deals, see our iPhone Price Tracker, updated daily.

Read more »

MacBook Neo Still In Stock at Walmart While Apple Slips to 2–3 Week Delays
The MacBook Neo continues to stay in stock across Walmart’s online store, even as availability tightens at many other retailers and Apple’s own delivery estimates have slipped to roughly 2–3 weeks for many configurations. Check current MacBook Neo availability at Walmart. What makes Walmart stand out right now is the combination of immediate availability, fast free shipping, and free local store pickup options (where available). For buyers who don’t want to wait weeks for Apple delivery windows, Walmart has quietly become one of the easiest places to actually get a MacBook Neo quickly. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.

Read more »

Upgraded 32GB/1TB 14″ M5 MacBook Pros Drop Up to $300 Off at Amazon & B&H
Amazon and B&H are now offering major discounts on Apple’s upgraded 32GB/1TB 14-inch M5 MacBook Pro configurations, with the Silver model down to $1799 and the Space Black version at $1849, compared to Apple’s standard $2099 MSRP. That works out to savings of $250-$300 off, making these some of the strongest discounts we’ve seen so far on upgraded M5 MacBook Pro models. Check the deals at Amazon and B&H. B&H is also continuing to offer free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

New 32GB/1TB M5 14″ MacBook Pro Drops to $1849 at Amazon, $250 off!
Amazon is now offering Apple’s new 32GB/1TB M5 14-inch MacBook Pro for $1849, down from Apple’s standard $1999 MSRP. That’s a clean $250 discount on one of the more desirable upgraded configurations in the lineup. Check current pricing at Amazon here. Deals on upgraded MacBook Pro configurations tend to arrive more slowly than base models, which makes this one stand out a bit more than the typical entry-level sale. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »