Voibe turns your Mac into a private, offline dictation machine for $50
Macworld TL;DR: Voibe lets you dictate text on your Mac faster than typing, for a one-time $49.99 fee. Typing is something we’ve seemingly always done. However, when you’re trying to keep up with your own thoughts, it can start to feel like a bottleneck. Voibe intends to change it all. Instead of typing everything out, you just hold a key, speak naturally, and your words appear on screen almost instantly. Right now, you can get lifetime access for $49.99 (regularly $199), which makes it an easy upgrade for anyone who writes a lot on a Mac. The standout feature is how it handles privacy. Unlike most dictation tools, Voibe runs entirely on your device. Your voice never gets sent to the cloud, which means faster results and no concerns about where your data is going. It also works across basically everything. Emails, documents, notes, messaging apps—if there’s a cursor, Voibe works. That makes it less of a “tool you open” and more something that improves your entire workflow. And because it’s optimized for Apple Silicon, it feels fast. No lag, no waiting, no breaking your train of thought. Whether you’re drafting emails, writing content, or just trying to get ideas out quickly, this is one of those upgrades that feels small—but saves time every single day. Get lifetime Voibe access for a one-time $49.99 (regularly $199). Voibe Lifetime SubscriptionSee Deal StackSocial prices subject to change.

Read more »

This is the last day to get the full Office suite on Mac for $45
Macworld TL;DR: Pay $44.97 once (MSRP $219), own Microsoft Office on your Mac forever. If you’ve been piecing together free apps or juggling subscriptions just to get your work done, this is your sign to simplify things. Right now, you can grab Microsoft Office Home & Business for Mac 2021 for just $44.97 (reg. $219)—and it’s a one-time purchase. No recurring fees, no surprise renewals, no “trial expired” notifications popping up mid-project. This version gives you the core apps most people actually rely on: Word for documents, Excel for spreadsheets, PowerPoint for presentations, and Outlook for email and scheduling. You also get Teams (basic) and OneNote for collaboration and organization, rounding out a setup that works just as well for home offices as it does for small business use. The experience is familiar, polished, and built for macOS, so everything runs smoothly without needing workarounds or compromises. Whether you’re managing projects, handling client work, or just staying organized, it’s the kind of toolkit that quietly keeps everything moving. And since the license is tied to your Microsoft account, you don’t have to worry about losing access—it’s yours to keep. Get lifetime access to Microsoft Office Home & Business for Mac 2021 for just $44.97 (reg. $219) through May 3 at 11:59 p.m. PT. Microsoft Office Home & Business for Mac 2021: Lifetime LicenseSee Deal StackSocial prices subject to change.

Read more »

May MacBook Pro deals deliver prices as low as $1,949 on M5 Pro & M5 Max models
Apple retailers have issued steeper discounts on the MacBook Pro for May, resulting in record-low prices on several M5 Pro and M5 Max 14-inch and 16-inch configurations.Grab steeper discounts on Apple's new MacBook Pro for May.Prices have dipped to as low as $1,949 for the 2026 MacBook Pro, with a variety of 14-inch and 16-inch configurations now up to $250 off. You can check out top deals below, with a full rundown of markdowns in our 14-inch MacBook Pro 2026 Price Guide and 16-inch MacBook Pro Price Guide.14-inch MacBook Pro M5 Pro and M5 Max deals Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple published a new Press Release
Apple just published a new Press Release:Apple reports second quarter results

Read more »

DJI Osmo 360 review: A better action camera choice
The DJI Osmo 360 is an excellent example of how to do a 360-degree camera system right. Its massive optional selfie stick is overkill for most people.DJI Osmo 360 and accessoriesApple has, in recent years, made its iPhones more useful for videography. However, while it has features like Action Mode to make it useful for filming fast activities, it's still not exactly the best choice for some more hazardous situations.In cases where someone wants to ski down a mountain, the action camera is still king. In cases where you want more control over how a shot is framed instead of a fixed-on-body position that looks bad, you need a 360-degree camera. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Indie App Spotlight: ‘This Day’ turns photo cleanup into a simple daily habit
Welcome to Indie App Spotlight. This is a weekly 9to5Mac series where we showcase the latest apps in the indie app world. If you’re a developer and would like your app featured, get in contact. Everyone probably has a massive photo library going back for years, maybe even over a decade. Over time, that consumes more and more storage – and this becomes a problem, especially if you’re paying for iCloud storage. On the other hand, decluttering isn’t easy. This Day turns photo decluttering into a habit, by designing an interface that allows you to address it one day at a time. more…

Read more »

Limited-time Apple Card promo offers $100 Bonus Daily Cash when you add a co-owner
Apple Card has been throwing around loads of limited-time sign up offers lately, but those only help new customers – not existing ones. This new offer, however, benefits existing Apple Card users. Through May 18th, Apple Card users can add a co-owner to their account and get $100 in Daily Cash after the new co-owner spends $100 in their first 30 days. more…

Read more »

xAI is bringing Grok Voice mode to Apple CarPlay
Apple CarPlay recently gained support for AI chatbots, and the third app to add support is coming soon: Grok. more…

Read more »

13-inch M5 MacBook Air 512GB is $149 Off
The M5 MacBook Air has been refreshed, given the M5 chip bringing you strong AI capabilities and performance in a device that you can bring anywhere, the device features unified memory and a faster CPU. The laptop features Apple Intelligence, a personal intelligence system that helps keep things organized and get things done effortlessly, you […] The post appeared first on iLounge.

Read more »

Two New Ultra Products to be Released by Apple
Two products will be given the Ultra branding by Apple this year. The upcoming foldable iPhone will receive the iPhone Ultra branding and will be the most expensive device in the iPhone line. The device will not be part of the upcoming line of the iPhone 18 Pro, but will only be released alongside it. […] The post appeared first on iLounge.

Read more »

IAM Union Accuses Apple of Unfair Labor Practice
Apple employees in Towson are being represented by the IAM Union and stated that they will be filing a charge for Unfair Labor Practice against the company with the National Labor Relations Board. Apple is allegedly conducting unlawful discrimination against unionized employees in the store. Apple has declared plans to close down the Apple Store […] The post appeared first on iLounge.

Read more »

Liquid Glass Display from 20th Anniversary iPhone to Make Bezels Non-Visible
The upcoming 20th anniversary iPhone is rumored to have a new curved screen type of technology that hides display bezels more effectively. A big redesign is planned for the 20th anniversary iPhone, rumored to have a display that curves around the 4 edges of the gadget. Apple is going to use a panel with an […] The post appeared first on iLounge.

Read more »

Kuxiu S4 25W Semi-Solid Wireless 10K Power Bank review: thinnest 10K magnetic power bank
Macworld At a glanceExpert's Rating Pros Slimmest-ever 10K power bank Semi-solid-state technology 25W wireless or 30W wired charging Kickstand Bright smart display Cons S3 has built-in cable Our Verdict The Kuxiu S4 is the slimmest 10K magnetic wireless power bank we have tested yet. If you want thinner, you’ll have to sacrifice half the battery capacity with a 5K battery pack. Price When Reviewed This value will show the geolocated pricing text for product undefined Best Pricing Today Price When Reviewed$89.99 Best Prices Today: Kuxiu S4 Semi-Solid Safe 25W Wireless 10K Power Bank Retailer Price Kuxiu $84.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket When we reviewed the Kuxiu S3 25W 10K Solid-State Power Bank we called it the “fast 25W wireless battery pack that has it all”. We were impressed by its built-in USB-C cable, integrated kickstand, and super-clear digital battery display. Now, the same company has released the S4 Power Bank. It’s not the S3 plus some more. In fact it’s a bit less than the S3, but in one aspect that’s great news—because the Kuxiu S4 is the slimmest 10K magnetic wireless power bank we’ve ever tested. And it’s pretty special in other ways, too. Simon Jary Power bank specs Capacity: 38.5Wh (10000mAh) Input charger: USB-C (30W) Output charger: Wireless (25W) & USB-C (30W) On test charged iPhone to: 177% Weight: 7.55oz (214g) Dimensions: 4.1 x 2.7 x 0.53 inches (104 x 69 x 13.7mm) Colors: Cosmic Orange, Black Battery capacity: 10000mAh (10K) is the largest battery size that you can clamp to the back of your MagSafe iPhone without it being too cumbersome to pocket—and small pockets will better appreciate a 5000mAh (5K) power bank. Read reviews of all the best magnetic power banks we have tested, both 5K and 10K. Not all 10K or 5K power banks have exactly the same capacity. To get more precise you need to look at the capacity in watt hours (Wh). The S4’s 38.5Wh is a smidge under the S3’s 39.5Wh. The average 10K battery capacity in watt hours is 37.9Wh. Speed: For power output the S4 is rated at the top 25W, using the latest Qi2.2 wireless charging technology. Only the iPhone 16 series and later can take all 25W, with older iPhones pegged back at 15W (still much faster than still-available 7.5W battery packs). Note that the 17e is also limited to 15W, and the iPhone Air to 20W. The S4’s USB-C port is rated at 30W so will charge your iPhone faster if you need to power up as quickly as possible, but you’ll need to bring a USB-C cable—unlike with the S3 that comes with its own built-in. The very fastest wired iPhone charging we’ve seen from a magnetic power bank is 45W from The Baseus PicoGo AM52, but it’s unlikely the iPhone will accept much more than 35W anyway. When recharging the S4 power bank, the power input is 30W—at the top end of magnetic wireless power bank range. Simon Jary Like the S3, the S4 is built using semi-solid-state (SSS) battery technology that’s engineered for superior safety, longevity and thermal stability compared to standard lithium-ion battery packs. You can skip the next bit if you’re not interested in technical details… What are Semi-Solid State batteries? Semi-Solid is a transition technology between traditional liquid lithium-ion batteries and all-solid-state batteries (ASSBs). When all solid-state batteries are mainstream, they will likely replace semi, but semi is as good as we have today. Once proven in electric vehicles, we expect to see ASSB power banks in by 2028. Why so long? All-solid-state batteries will require new manufacturing facilities, while semi-solid-state batteries are compatible with existing lithium-ion production lines, requiring only minimal (10-20%) new equipment. As such, ASSBs will be expensive—maybe 3-4x—than traditional batteries and so are unlikely to be seen in mainstream laptops until manufacturing ramps up and costs go down.. SSS batteries replace a large portion of flammable liquid electrolyte with a gel or slurry, typically only 5–10% liquid remains. The reduction of flammable liquid significantly lowers the risks of thermal runaway, leakage, and fire. They are more resistant to extreme heat and physical damage. This is why we expect airlines to allow only solid-state batteries on flights in the future. This improved thermal stability also means the batteries should perform better in colder temperatures. Aside from greater safety, solid-state tech allows the battery to have a higher energy density, so they can be made smaller. They should also last longer with a greater number of possible charge cycles before capacity degradation. Simon Jary Thinnest design yet Kuxiu calls the aluminum-alloy S4 “the world’s thinnest 10,000mAh semi-solid-state cell”, and it’s not wrong. 13.7mm is the thinnest 10K power bank we’ve tested. The previous champ, the Anker MagGo 10K Slim, is a full millimeter thicker and offers only 15W power output. The average depth of a 10K power bank is 18.2mm. Some other 10K power banks are 16mm or 17mm deep, but the average is 20-22mm. The S4 is a third thinner than those chunky beasts. Let’s be honest, it’s not a sliver of a power bank—it still looks large compared to the thinnest 5K battery packs—but it is the slimmest 10K. Even the 5K power banks we’ve tested average out at 10.7mm depth, although the slimmest of all (the BMX SolidSafe Air 5K) is a mere 6.8mm deep. Kuxiu S4 vs Kuxiu S3: slim vs cable The S4 is noticeably slimmer than the S3 but lacks its long integrated USB-C cable. That means Kuxiu has been able to make the S4 over 35% slimmer—14mm vs 22cm. While we love a built-in cable on a magnetic power bank (wired charging is always faster and a cable makes recharging the power bank itself less hassle), we also desire them to be as slim as can be. That’s the major compromise between choosing between the S3 and S4, but there are more differences. Read our Kuxiu S3 review for more details. Both power banks feature a stand, and the S3’s stand is larger and more robust than the S4’s bottom-mounted pull-out but the S4’s performs well enough. Simon Jary Both have a digital display so you can see precisely how much power remains in the power bank—most make do with four tiny LEDs, each of which represents 25% battery charge, compared to the exact number a digital display readout gives you. The S3’s is clear to read but shows just the remaining battery charge. The TFT display on the S4—tucked behind the stand—is smarter and more colorful, showing battery health, operating temperature, battery level (remaining charge), wireless charging power and USB-C input/output power plus battery safety alerts where appropriate. You might not need to know all that info but it’s there, presented on three digital circles. Finally, the Kuxiu S4 is available in a stunning Cosmic Orange to match the iPhone 17 Pro and Pro Max as well as the same Black as the S3. Recharging performance At Macworld we produce a battery performance report for all the power banks that pass through our labs. There’s nothing fancy involving microscopes and spectrometers. We simply drain an iPhone’s battery to 0%, connect the power bank and see how many times it can recharge the phone. If it fills the phone up with juice to spare, we wait till the phone has run out again and repeat until the power bank is empty. The best score we have got from a 10000mAh (10K) power bank is 190% (the 15W EcoFlow RAPID 10K), with an average score of 166%. The Kuxiu S4 scored an above-average 172%—around the same ballpark as the S3. The Kuxiu S4 is available in a striking Cosmic Orange color to match the iPhone 17 Pro/Max, or a more standard Black.Kuxiu Price The Kuxiu S4 10K Magnetic Power Bank is priced at $84.99 or £64. The S3 is cheaper at $68.99/£54, even with its integrated cable. If you want the thinnest 10K magnetic power bank, you’ll need to dig a bit deeper, but your trouser-pocket lining may thank you for it over the long term. For more options we have tested and reviewed the best magnetic wireless power banks. Should you buy the Kuxiu S4 25W Wireless 10K Power Bank? First things first: the Kuxiu S4 is the slimmest 10K magnetic wireless power bank we have tested yet. If you want thinner, you’ll have to sacrifice half the battery capacity with a 5K battery pack. The S4 performed above average in our recharging tests. If you can sacrifice the slimness, consider its S3 sibling that boasts an integrated USB-C cable, but we salute the S4 for being the slim semi-solid-state champion… and we love the Cosmic Orange option.

Read more »

Today in Apple history: Apple’s first watch is a freebie for upgraders
On May 2, 1995, Apple launched its first Apple watch -- a giveaway gadget for anyone paying to upgrade to System 7.5 on the Mac. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

What’s the future for the Vision Pro? [Cult of Mac podcast No. 18]
This week on the Cult of Mac podcast: A slightly suspect rumor indicates Apple pulled the plug on the Vision Pro headset. Wait, what?!? (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Eddy Cue hopes for 'F1' movie sequel, increased streaming rights
Apple is keen for there to be a sequel to "F1: The Movie," SVP Eddy Cue said, as the company hopes to increase its involvement with the motorsport in the future.Apple has big plans for its F1 streaming service. Image source: AppleApple has multiple connections to Formula 1, with it being the official broadcaster of the sport in the United States. It's also behind the Brad Pitt vehicle "F1: The Movie," which is also Apple TV's most-watched movie.With those successes in hand, Apple is planning for there to be more to both sides of the story. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Get a Visual Studio Pro lifetime license on sale for $35 (regularly $499.99)
Get a full coding environment for building, testing, debugging and collaborating on projects with this Microsoft Visual Studio Pro 2026 deal. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

These are my top 8 must-have Vision Pro accessories
If you shelled out well over $3,499 for a Vision Pro, hopefully you have some money left over to buy some must-have headset accessories. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Apple @ Work: Unpacking the top mobile threats facing your Apple fleet this year
Apple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional-grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. If you spend enough time managing Apple devices in an enterprise environment, you start to spot patterns in how security incidents happen. It is rarely a cinematic Ocean’s 11-style hack. Instead, it is usually a user delaying an iOS update for three months or an employee connecting to an open Wi-Fi network at a hotel or coffee shop. Jamf recently released its Security 360: Annual Trends Report on Mobile Devices, and the data paints a very clear picture of the vulnerabilities that IT departments are currently facing. Even in the age of AI, what’s old is new again more…

Read more »

Mac mini is the best platform for Perplexity's Personal Computer
Perplexity's Personal Computer arrived on Mac first because it was the best for locally deploying the agentic AI platform, the company has declared.An example of Perplexity Personal Computer at work, from a promotional videoDuring Apple's quarterly financial results. CEO Kevan Parekh referenced to the growing use of the Mac as a base of operations for AI platforms. Parekh namechecked Perplexity as one such company, taking advantage of Apple Silicon and its unified memory structure.Ahead of Apple's results release and analyst call, Perplexity CEO Aravind Srinivas talked about the Mac during its Ask NYC enterprise and finance event. Specifically, how Personal Computer, its agentic AI platform that works with local files, was made for use on Mac. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Your packed schedule just met a faster way to learn new ideas — Headway is a one-time $48
Macworld TL;DR: Get lifetime access to Headway’s 15-minute nonfiction summaries for $47.97 (MSRP $299.95) through May 10. That ever-growing reading list can be hard to keep up with when your day is already packed. Headway Premium, now $47.97 for a lifetime subscription, helps you stay on top of it by turning top nonfiction into quick, digestible summaries you can finish in minutes instead of hours. Think of Headway as your personal “big-idea shortcut.” You get unlimited access to 2,000+ nonfiction summaries, each distilled into an easy 15-minute read or listen. Plus, more are added all the time. Personal growth, business, productivity, psychology, health — if someone wrote a bestselling book about it, there’s a good chance it’s already in Headway. And this isn’t passive skimming. Headway makes learning feel like a game. You can complete self-growth plans, quiz yourself, collect streaks, browse curated collections, dive into bite-sized facts, save highlights, and even explore interactive role-play content to sharpen real-life skills. Offline access also means your growth streak doesn’t die on the plane or subway. For anyone trying to learn more this year—without sacrificing precious free time—Headway Premium is the smartest deal running. Get lifetime access to Headway Premium while it’s $47.97 (MSRP $299.95) until May 10. Headway Premium: Lifetime SubscriptionSee Deal StackSocial prices subject to change.

Read more »

You’re not dreaming — this MacBook Air refurb is less than $200
Macworld TL;DR: This 2017 13.3″ refurbished MacBook Air is down to just $199.97 (MSRP $999) through May 10 — a budget-friendly way to pick up a classic Apple laptop that still handles daily tasks with ease. MacBook pricing usually scares people off — this deal flips the script. For $199.97 through May 10, you can score a refurbished 13.3-inch 2017 Air model that delivers the classic Apple feel without the classic Apple cost. From its ultra-slim aluminum design to the fast 1.8GHz Intel Core i5 processor, this laptop can keep up with your busiest days. The 128GB SSD provides ample storage for your important files and favorite apps while ensuring lightning-fast boot times. Whether working remotely or streaming your favorite shows, the 12-hour battery life and Wi-Fi connectivity will keep you going. Plus, with Intel HD Graphics 6000, you’ll enjoy smooth visuals, whether tackling spreadsheets or binge-watching on Netflix. This MacBook Air is either grade-A or grade-B refurbished, which means it’s in great working condition with light or no cosmetic imperfections. It’s been tested, cleaned, and certified to meet high-performance standards. Don’t miss the chance to get a MacBook Air for less than a week’s worth of groceries.  This refurbished MacBook Air is available for just $199.97 (MSRP $999) through May 10. Apple MacBook Air (2017) 13″ i5 1.8GHz 8GB RAM 128GB SSD Silver (Refurbished)See Deal StackSocial prices subject to change.

Read more »

M4 Mac mini now costs more as Apple drops 256GB model
Apple discontinued the 256GB M4 Mac mini, raising the base configuration storage to 512GB with a $799 starting price. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

I think I just vibe coded Lil Finder Guy onto my Mac
Look, it’s Friday. OpenAI updated Codex. It has Tamagotchi-style pets. You can make your own. Lil Finder Guy is hovering over my Dock. more…

Read more »

Apple escalates fight with India antitrust watchdog over access to global financials
Apple has accused the Competition Commission of India (CCI) of overstepping its judicial authority in a new court filing tied to an ongoing antitrust case in the country. Here are the details. more…

Read more »

WhatsApp working to bring Liquid Glass to the in-chat interface
As WhatsApp continues its glacially-paced rollout of the Liquid Glass look to the main Chats screen, Meta is also working to add the revamped look to the in-chat interface. Here are the details. more…

Read more »

Miami GP: Cue talks F1 movie sequel, streaming rights expansion, Ternus’s love for racing
As the 2026 F1 season lands in Miami for the first of three U.S. races for the year, Apple SVP of Services and Health Eddy Cue spoke to the press about the company’s growing involvement in the sport, including John Ternus’s passion for racing. Here are the details. more…

Read more »

Apple just gave a clue that a major AI acquisition may be coming
As Apple gears up to roll out its highly anticipated AI features later this year, a notable shift in its financial strategy is fueling… The post appeared first on MacDailyNews.

Read more »

iPhone and Services Drive Apple to Record Q2 2026 Despite Supply Constraints
Apple reported record financial results for what it described as its “best March quarter ever,” with over $29 billion in profits and double-digit growth across every geographic segment as the Tim Cook era approaches its end.

Read more »

Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.

Read more »

Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction  Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access  Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH  Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH  Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH  faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field  Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter  Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service  Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002  Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service  Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field  Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow  Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName  icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection  Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command  Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field  infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import  faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow  Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service  Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields  Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG  ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion  Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog  Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service  Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input  Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service  Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service  Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory  Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow  Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field  P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field  Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow  94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields  Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service  Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server  Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow  Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field  P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service  Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001  OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763  HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605  IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907  hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php  Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209  Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html  Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet  Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/  Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki  EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95  Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf  Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server  ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes  PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0  Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech  Back to top

Read more »

‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.

Read more »

Most secure browser for Mac in 2026
For most Mac users, your browser is where a lot of online life happens — reading emails, logging into accounts, using web apps, shopping, and banking. It’s also where a small mistake can lead to a bigger problem, whether that means downloading something that looked harmless or signing into a phishing page that seemed real […] The post appeared first on The Mac Security Blog.

Read more »

Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.

Read more »

Why more Mac attacks now rely on social engineering
Recent security findings suggest a change in how Mac users are being targeted. Instead of searching for technical gaps in software, attackers are finding ways to ask users to run commands themselves. This pattern shows up across different reports, from fake apps that look legitimate to scam pages that guide users into pasting commands into […] The post appeared first on The Mac Security Blog.

Read more »

The new Intego Antivirus is here — everything you need to know about Intego ONE
Intego ONE is Intego’s new all-in-one Mac security app, built to make protection easier to manage in one place. Instead of juggling separate tools, you get antivirus protection, firewall protection, SmartClean, and VPN in one Mac-focused app, depending on your plan. If you’ve used Intego products before, the shift is straightforward — fewer moving parts […] The post appeared first on The Mac Security Blog.

Read more »

Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.

Read more »

The ultimate guide to Mac security
Macs have a strong security foundation. That’s true — and it’s worth appreciating. But “safer than” doesn’t mean “safe from.” Modern Mac threats don’t always look like the classic virus people imagine. A lot of today’s attacks rely on social engineering, fake installers, stolen credentials, and the simple reality that people download things, click prompts, […] The post appeared first on The Mac Security Blog.

Read more »

How to Choose the Right iPhone (2026): A Simple Guide
While the latest iPhone is the best and fastest model every year, you might not need its features. Apple sells several iPhone models; here's how to choose the right iPhone for your needs. The post appeared first on The Mac Security Blog.

Read more »

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.

Read more »

Compare MacBook Neo prices instantly across retailers with our easy price tracker—see deals, stock status, and savings at a glance.
Our exclusive MacBook Neo Price Tracker makes it incredibly easy to see exactly where to find the best deal—without wasting time jumping between retailer sites. Instead of digging through multiple tabs, everything is right there in one simple, clean table. You can instantly compare prices across Apple’s major retailers and see which store is offering the lowest price at any given moment. Even better, the tracker shows current sale prices side-by-side with Apple’s MSRP, so you know exactly how much you’re saving. One of the most useful features is the at-a-glance stock status. A quick glance tells you which retailers actually have the MacBook Neo available for delivery within a reasonable timeframe, helping you avoid the frustration of clicking through to an out-of-stock product page. And because deals change fast, the page is designed for speed and simplicity—prices are visible immediately above the fold, making it easy to check for updates anytime you visit.

Read more »

Best iPad Air Deals Right Now — Up to $100 Off M4 Models at Amazon
Amazon’s iPad Air discounts are strongest on the higher-storage models right now, with the 13-inch 1TB configuration showing the biggest savings at $100 off Apple’s MSRP. The 11-inch models are also seeing useful discounts, especially if you want a lighter tablet at a lower starting price. Check Amazon’s 11-inch iPad Air deals here. If you want the larger display, Amazon’s 13-inch iPad Air deals are where the biggest dollar savings show up, with several configurations priced well below Apple’s standard pricing. Shop Amazon’s 13-inch iPad Air deals here. For the latest sales and deals, see our iPad Air Price Tracker, updated daily.

Read more »

16″ M5 Pro MacBook Pro Deals Hit Amazon — Up to $200 Off Key Configs
Amazon is starting to roll out more meaningful discounts on Apple’s 16-inch M5 Pro MacBook Pro lineup, with select configurations now seeing price cuts of up to $200. The 24GB/1TB model is currently $150 off, while the higher-end 48GB/1TB version is seeing a full $200 discount—bringing both models below their usual pricing for the first time. These are the kinds of early deals that signal broader price movement across the lineup, especially for higher-memory configurations. You can check current deals here: 24GB/1TB model and 48GB/1TB model. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

16″ M5 Max MacBook Pros $200 off at B&H — Fast Free Shipping Included
B&H Photo is now offering $200 off Apple’s 16-inch M5 Max MacBook Pro lineup, bringing prices down across multiple high-end configurations. With Apple’s MSRP starting around $3899 for these models, that discount is one of the first meaningful price drops we’ve seen so far. What makes this deal stand out even more is B&H’s free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. You can check current configurations here at B&H Photo. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Metro by T-Mobile Drops iPhone 17e to $349 — $250 Off with Port-In
Metro by T-Mobile is currently offering one of the more straightforward iPhone deals out there, knocking $250 off the iPhone 17e and bringing the price down to $349.99 with an instant discount at checkout. There’s no complicated bill credit structure here—you just need to bring your number, sign up for a qualifying plan, and pay your first month of service. Plans start at $55 for the first month and drop to $50 with AutoPay. You can check the deal here: Metro by T-Mobile. For the latest sales and deals, see our iPhone Price Tracker, updated daily.

Read more »

MacBook Neo Now Fully In Stock at Walmart — Easy Ordering & Pickup Available
MacBook Neo availability at Walmart has shifted in a big way—every configuration is now in stock and ready to order. Instead of scattered availability, buyers can now choose from the full lineup with confidence, whether ordering online for free shipping or selecting local store pickup where available. This makes Walmart one of the easiest places right now to actually get a MacBook Neo without worrying about inventory gaps. If you’ve been waiting for wider availability, this is a much smoother buying window. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.

Read more »

AirPods Deals Compared: Amazon vs Walmart vs Apple Pricing Right Now
AirPods deals are lining up across Amazon and Walmart, and for once it’s easy to compare real savings across the lineup. The base AirPods 4 are down to about $99 (vs $129 MSRP), while AirPods Pro 3 models are holding around $199 compared to Apple’s $249 price. Walmart often matches or slightly undercuts Amazon—and adds the option for local pickup or fast shipping. You can check current deals here: AirPods at Amazon and AirPods at Walmart. For the latest sales and deals, see our AirPods Price Tracker, updated daily.

Read more »

14″ M5 Pro MacBook Pro Deals Expand — Amazon Discounts All Configurations
The 14-inch M5 Pro MacBook Pro lineup is finally starting to see broader discounts, and this time it’s not just one or two configurations. Amazon is now offering deals across all eight configurations, from base 16GB/512GB models to higher-end memory and storage options. These early discounts, ranging up to $237 off MSRP, are typically the first sign that pricing is beginning to shift away from launch levels. If you’ve been waiting for a deal on a 14″ M5 Pro, this is the first moment where the entire lineup becomes worth a closer look. View deals here at Amazon. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

MacBook Neo Stock Is Moving Fast at Walmart — Here’s What’s Still Available
MacBook Neo stock at Walmart is already splitting between easy-to-order models and sold-out configurations. Several versions are still available online with free shipping, and some also show local pickup options depending on your area, while others are already out of stock. You can check a few of the live Walmart listings here. If you’re flexible on color or storage, you still have options — but some of the most popular versions are clearly moving fast. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.

Read more »

13″ M5 MacBook Air Deals Expand — Amazon & B&H Drop Prices Across the Lineup
The 13-inch M5 MacBook Air is starting to see real discounts, and this time it’s not just one configuration. Amazon and B&H are both offering $150 off multiple models, with prices dropping across the lineup. The 512GB model is now down to about $949, while higher-end configs are also seeing meaningful cuts. These are some of the best early deals we’ve seen on Apple’s latest ultra-portable. You can check current pricing at Amazon and B&H Photo. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Verizon iPhone 17 Deals: Full Breakdown on iPhone 17 Pro Max, 17 Pro, 17 Air, 17, and 17e
Verizon’s current iPhone 17 promotions cover the full lineup, from the flagship iPhone 17 Pro Max down to the entry-level iPhone 17e, and the offers are broad enough that shoppers really need to look beyond the headline pricing. Depending on the model, Verizon is currently promoting a mix of bill-credit discounts, trade-in savings, switcher incentives, free-phone offers, and bonus bundle offers tied to eligible Unlimited plans. On MacPrices’ iPhone tracker, Verizon’s currently advertised effective prices include the iPhone 17 Pro Max from $199, the iPhone 17 Pro from $99, the iPhone 17 Air from $0, the iPhone 17 from $0, and the iPhone 17e free with eligible service promotions. If you want to shop Verizon’s current offers directly, you can browse Verizon’s iPhone deals here. And for side-by-side comparisons with Apple and other carriers, along with the latest promo pricing updates, visit our iPhone Price Tracker, updated daily.

Read more »

Week’s Best Apple Deals: M5 MacBook Air Discounts, $200 Off MacBook Pro, Free iPhone 17e, and More
Apple deals stayed strong this week, with first-time discounts hitting the new M5 MacBook Air lineup, a clearance 14-inch M5 MacBook Pro dropping to $1399, the first real Studio Display sale, and fresh Apple Watch discounts across major retailers. Carrier buyers also have a standout option right now, with Metro by T-Mobile offering up to $300 off iPhone 17 models and a free iPhone 17e with a new line and number transfer. For the latest Apple sales and price changes, check MacPrices.net’s price trackers updated daily.

Read more »