WhatsApp makes parent-managed accounts easier to set up on iPhone
WhatsApp is bringing its dedicated parental controls section to the iPhone, making the feature easier for parents to find and set up. Here are the details.

Read more »

Apple adds nearly 45 hearing devices to its Made for iPhone compatibility list
Apple updated its list of Made for iPhone (MFi) hearing devices today, with 43 models across 22 brands. Here’s what’s new.

Read more »

CarPlay connection issues? This might explain why
If your Apple CarPlay connection randomly drops out while driving, the cause might not be your iPhone, cable, or car.

Read more »

Claude Code now lets sessions talk to each other on macOS
Users running the latest version of Claude Code on macOS and Linux can now have their sessions message each other to share findings, ask questions, and coordinate work. Here are the details.

Read more »

9to5Mac Overtime 076: Native retro games on iPhone
Fernando discusses his Pokémon 3D Mod on Mac, and Jeff shares his experience running a native port of Mario Kart 64 on iPhone. The guys also discuss why tech can feel less exciting than it used to, and share their thoughts on using the same device for many years. 9to5Mac Overtime is a weekly video-first podcast exploring fun and interesting observations in the Apple ecosystem, featuring 9to5Mac’s Fernando Silva & Jeff Benjamin. Subscribe to Overtime via Apple Podcasts and our YouTube channel for more.

Read more »

James Marsden to star in Apple TV comedy ‘Bad News Dads’ from Stephen Falk and Berlanti Productions
Apple TV is developing "Bad News Dads," a half-hour comedy starring and executive produced by James Marsden. The project comes from… The post appeared first on MacDailyNews.

Read more »

‘Your Friends & Neighbors’ star confirmed for his third Apple TV project
Actor James Marsden, who recently played billionaire Owen Ashe in the second season of Your Friends & Neighbors, was confirmed this week for his Apple TV third production. Here are the details.

Read more »

iOS 26.6.1 imminent: Apple internally testing quick follow-up update for iPhones
Apple is actively testing iOS 26.6.1, a point release that appears poised for release in the coming days, according to visitor logs tracked… The post appeared first on MacDailyNews.

Read more »

iPhone 17 might get price increase next week, per new rumor
Apple is widely expected to raise iPhone prices when the iPhone 18 Pro launches next month. But a new rumor suggests the iPhone 17 might get a price increase as early as next week.

Read more »

iOS 27 has long-awaited fix for common iPhone wireless issue
In iOS 27, Apple says it took extra care to make its software “more responsive, reliable, and delightful.” There are a variety of fixes that should make your iPhone faster, including one update for network transitions.

Read more »

You may soon be able to create and export custom WhatsApp stickers straight from ChatGPT
OpenAI is working on a feature that allows users to export custom stickers created on ChatGPT straight into WhatsApp. Here are the details.

Read more »

Apple’s iPhone captures 65% of global premium smartphone market as segment hits record 29% share in H1 2026
Apple dominated the premium smartphone segment in the first half of 2026, holding a commanding 65% market share… The post appeared first on MacDailyNews.

Read more »

These automakers still don’t support CarPlay, here’s why
CarPlay is a must-have for the majority of car buyers, but three major automakers don’t support the platform. Here’s the latest on why Tesla, Rivian, and GM continue to resist CarPlay — and whether there’s any chance they change their approach.

Read more »

Apple is allegedly scrambling to get enough RAM for the iPhone 18 Pro
Macworld Former Bloomberg correspondant and supply-chain expert Tim Culpan has bad news. A brief post on his Substack blog say that Apple isn’t immune to the RAM crunch that is affecting everyone right now. The company is scrambling to get DRAM modules from suppliers to the assembly plants for the iPhone 18 Pro and iPhone Ultra. With less than two months before the phones ship out to consumers, production should be in full swing right now. But a shortage of DRAM chips means they’re not able to manufacture as many as they would like. It sounds like the iPhone 18 Pro may be in short supply when it first goes on sale. The iPhone Ultra, with a much higher price tag, is expected to have lower demand. It also may have a slightly later shipping date, giving a little more time for production to catch up. The iPhone 18 Pro and iPhone Ultra should be announced at a special event in the second week of September, and ship to consumers in late September or early October.

Read more »

New AirPods could launch next month, and one feature sounds very exciting
Apple’s iPhone 18 Pro unveiling next month might also bring the launch of new AirPods with cameras. Here’s why the addition of cameras could prove especially compelling.

Read more »

PSA: Claude Code enabling auto mode as default next week, Anthropic says
Claude Code auto mode will become the default permission setting for users next week. Starting August 14, sessions for Pro, Max, and Team users will use it unless a user or administrator has pinned another setting.

Read more »

Apple Arcade in August: Four new games added to the service this month
Macworld Gaming subscription services are all the rage now, but Apple Arcade isn’t a little different from the likes of PlayStation Plus, EA Play, or Xbox Game Pass. If you’ve got questions about it, we’ve got plenty of answers. Updated August 7, 2026: There are four new games on the service again this month: Everyday Puzzles: Mini Games+, Madden NFL 27 Arcade Edition, Retro Bowl College+, and Water Sort Puzzle: Get Color+. What is Apple Arcade? Apple Arcade is a gaming subscription service for iPhone, iPad, Mac, and AppleTV that features several hundred games. The games are a mix of genres and styles, and include original games you’ll only find on the service and others that can be found on the regular App Store or even other platforms. Apple Arcade isn’t a streaming service like Xbox Live Cloud Gaming or GeForce NOW. Games must be downloaded onto your device in order to be played. What do I need to run it? Apple Arcade was made available as part of iOS 13, iPad OS 13, tvOS 13, and macOS Catalina or later. Some of the more visually-intensive games may only run well on newer hardware, though, and some Mac games require macOS 11 (Big Sur). How much does Apple Arcade cost? Apple Arcade costs $6.99/£6.99 per month, and you’ll also get a one-month free trial or you can get three months free if you purchase a new iPhone, iPad, Apple TV or Mac. To claim your free trial click here. You can get Apple Arcade for less than $6.99 a month if you subscribe for a year upfront. A year of Apple Arcade is $49.99/£49.99 (so $4.16 a month). If you’re currently on the $6.99 month-to-month plan and want to switch to the annual plan and save some money, you can do so on your iPhone or iPad. Open the App Store app, then tap your account icon in the upper right. Tap Subscriptions, then tap the entry for Apple Arcade. Here, you can switch to the annual plan. Apple Arcade is also included in the Apple One subscription bundles, which range from $20 a month to $38 a month and include access to Apple Music and Apple TV and iCloud storage. There is also a month free trial of Apple One. To claim the trial, or sign up for Apple One, click here. How do I sign up for Apple Arcade? There isn’t an Apple Arcade app—it’s built into the App Store. On your iPhone, iPad, or Mac open the App Store and look for the Apple Arcade tab at the bottom of the screen (or in the left column on macOS). A sign-up screen with a Try It Free button will appear. After the trial you’ll be charged either the monthly or annual fee, depending on your selection. When subscribing, you’ll need to enter your Apple ID password or use Touch ID or Face ID to sign in, and you’ll have to confirm your subscription purchase a few times. Once you’re done with the sign up, the Arcade section of the App Store shows what games are available to you. To access a game, tap on it in the App Store, then tap the Get button. When the game is done installing on your device, the Get button turns into a Play button, and you can tap it to launch the game. The game app icon will also appear on your device’s Home page. On the Apple TV, there actually is an Arcade app. Open that to see the sign-up offer. You’ll also find an Arcade tab within the App Store. Does my subscription include family sharing? Yes. One $6.99 per month subscription can be shared between up to six people (including you). How do I cancel Apple Arcade? First off, keep in mind that if you cancel Apple Arcade (either before your free trial is up or after subscribing), you won’t be able to keep playing the games unless you re-subscribe. If you’re okay with that, you can use the same process you use to cancel any other subscription service. Here’s the easiest way to do it on the iPhone and iPad: Open the App Store app and tap on your profile photo in the upper right. In the screen that pops up, press Subscriptions near the top of the page. You’ll then see a list of active subscriptions, and Apple Arcade should be listed there. Tap it. You’ll either see Cancel Free Trial or Cancel Subscription toward the middle of the page that appears. Tap whatever option is available, then Confirm Cancellation. And here’s how to cancel Apple Arcade on the Mac: Open the App Store app and then press the icon with your profile photo in the lower left. The Account window will appear, and you should then click View Information at the top of the window. Enter your password when/if prompted. When your Account Information appears, scroll down to the Manage section and click the Manage link to the right of Subscriptions. When the list of your active subscriptions appears, click Edit to the right of Apple Arcade. Toward the middle of the page that appears, you’ll see a button that says either Cancel Free Trial or Cancel Subscription. Click it, then click Confirm Cancellation and Confirm. Do Apple Arcade games have in-app purchases? No. In Apple’s words, “since every game includes access to the full experience, including all game features, content, and future updates, no additional purchases will be required.” Even games that have in-app purchases on the App Store won’t have any in Apple Arcade. Do Apple Arcade games have ads? Also no. On a related note, Apple says Apple Arcade has no ad tracking. Is Apple Arcade a game streaming service like GeForce NOW or Xbox Game Streaming? No. All Apple Arcade are downloaded. Are there demos for Apple Arcade games? No, and they’re not really necessary. Like App Store apps, games download quickly and can easily be removed if you don’t want to keep it anymore. Apple partly envisions Apple Arcade as a way of letting players try out games with more freedom than the App Store currently allows (which is basically none). In Apple’s words, “rather than pay upfront for each game, a subscription to Apple Arcade will give players the opportunity to try any game in the service without risk.” The service has a free trial, though, as we’ve seen with other Apple subscription services. Am I able to keep playing Apple Arcade games if I cancel my subscription? No. As with most subscription services, you only have access while you’re a subscriber. Can I use controllers with Apple Arcade games? Yes. In additional to traditional MFi (Made for iOS) controllers, you can pair some specific Bluetooth controllers for either PlayStation or Xbox with either your iPhone, iPad, or Apple TV. Since many Apple Arcade games are playable on Mac and Apple TV (where controller support is more common), many games will support them. Some games, especially those that are also available in the broader App Store and only for iPhone or iPad, have no controller support. Recently Apple relaxed the requirements for MFi controller certification, which may have grown out of the Apple Arcade negotiations. How often are new games released? Games are typically released on the first Friday of each month. There are some rare exceptions. What games have been released so far? There are over 200 games available for Apple Arcade, and the list grows all the time. TitlePublisherRelease DateA Slight Change of Sawblades+Yong Kian Chin05/02/24Alba: A Wildlife Adventureustwo12/11/20Alto’s Odyssey: The Lost CityTeam Alto / Snowman07/16/21Alto’s Adventure—RemasteredTeam Alto / Snowman03/25/22Arkanoid vs Space Invaders+TAITO Corporation11/07/24Angry Birds BounceRovio09/03/25Angry Birds ReloadedRovio07/16/21Asphalt 8: Airborne+Gameloft08/27/21Badland PartyHypeHype Oy05/06/22Balatro+Playstack09/26/24Ballistic BaseballGameloft10/18/19Barbie Color Creations+StoryToys Limited12/05/24BEAST: Bio Exo Arena Suit TeamOh BiBi02/01/24Beyond a Steel SkyRevolution Software06/26/20Big Time SportsFrosty Pop Games09/19/19Blackjack by MobilityWare+MobilityWare01/05/24Bleak SwordDevolver Digital09/19/19Bloons TD Battles 2+Ninja Kiwi03/07/24Boggle: Arcade EditionZynga12/05/24Bold Moves+Red Games Co.06/09/23Bridge Constructor+Headup GmbH02/04/22Card of DarknessPendleton Ward09/19/19Castle CrumbleOrbital Knight02/03/23Castlevania: Grimoire of SoulsKonami09/17/21Charrua SoccerBatovi Games02/07/20Chess Universe+Tilting Point05/04/23Cityscapes: Sim BuilderPlaystack05/04/23Clue: The Classic Mystery Game+Marmalade Game Studio03/24/23Coffee Inc. 2+Side Labs06/04/26Cooking Mama: Cuisine!Office Create Corp.06/17/22CornsweeperRobert Morrison01/05/24Cozy Caravan5 Lives Studios01/08/26Crayola AdventuresRed Games Co.03/07/24Crayola Create and Play+Red Games Co.10/29/21Crayola Scribble Scrubbie+Red Games Co.09/03/25Crazy Eights: Card Games+MobilityWare03/06/25CreaksAmanita Design07/10/20Creatures of the Deep+Infinite Dreams07/02/26Cricket Through the AgesDevolver Digital09/19/19Crossword Jam+PlaySimple Games10/20/23Crossy Road+Hipster Whale10/08/21Crossy Road CastleHipster Whale02/28/20Cult of the LambDevolver12/04/25Cut the Rope 3SeptoLab UK10/13/23Cut the Rope RemasteredPaladin Studios04/02/21Cypher 007Tilting Point09/29/23Dandara: Trials of Fear+Raw Fury12/03/21Dead Cells+Playdigious12/02/22Dear ReaderLocal No. 1209/19/19Delicious — Miracle of Life+GameHouse11/24/23Dicey Dungeons+Distractionware05/02/24Disney Coloring World+StoryToys Entertainment05/04/23Disney Dreamlight ValleyGameloft12/05/23Disney Getaway Blast+Gameloft05/04/23Disney SpellStruckArtist Arcade05/04/23Doctor Who: An Unlikely HeistTilting Point04/07/23Dominoes: Classic Tile Game+MobilityWare10/02/25Doodle God UniverseJoyBits07/16/21Doodle Jump 2+Lima Sky02/06/25Doraemon Dorayaki Shop Story+Kairosoft Co.03/05/26Downwell+Devolver11/17/23Draw It+Kwalee07/02/26Dredge+Black Salt Games04/02/26Drive Ahead! CarcadeDodreams Fairytale Company11/07/24Dungeon Clawler+Stray Fawn Studio07/02/26Easy Come Easy GolfClaphanz02/04/21Episode XOXOEpisode Interactive01/06/23Everybody ShogiAltPlus08/07/25Everyday Puzzles: Mini Games+Fanatee08/06/26Fabulous – Wedding Disaster+GameHouse06/06/24Family Feud PocketGameLoft06/30/26FantasianMistwalker04/01/21Farming Simulator 20+Giants Software05/04/23FarmsideThe Label02/17/23Felicity’s DoorArea 3502/05/26FFIV: The After YearsSquare Enix12/09/24Final Fantasy+Square Enix01/10/25Final Fantasy IV (3D Remake)Square Enix12/09/24FinitySeabaa08/25/23Flow Free+Big Duck Games03/05/26Food Truck Pup+Game Start10/03/24Football Manager 2023 TouchSEGA11/08/22Free Cell Solitaire: Card Game+MobilityWare06/04/26Frogger in Toy TownKonami09/19/19Furistas Cat Cafe+Runaway10/03/24Galaga Wars+Bandai Namco11/12/21Game Dev Story+Kairosoft Co., Ltd06/18/21Game RoomResolution Games01/20/24Garden Tails: Match and GrowPlaydots, Inc.09/16/22Gear.Club StradaleEden Games04/08/22Getting Over It+Bennett Foddy05/04/23Gibbon: Beyond the TreesBroken Rules02/25/22Gin Rummy Classic+MobilityWare10/07/22Goat Simulator+Coffee Stain Publishing05/13/22Good Pizza, Great Pizza+Tapblaze05/07/26Grand Mountain Adventure+Toppluva04/28/23GrindstoneCapybara Games09/19/19Hearts: Card Game+MobilityWare01/07/22Helix Jump+Voodoo06/05/25Hello Kitty Island AdventureSunblink07/28/23Hidden Folks+Adriaan de Jongh01/28/22Hill Climb Racing+Fingersoft05/04/23Horizon Chase 2Aquiris Game Studio09/09/22Hot LavaKlei Entertainment09/19/19Hot Wheels: Race Off+Hutch Games12/05/24Human: Fall Flat+505 Games03/31/23HYKE: Northern Light(s)Akatsuki Games04/02/26I Love Hue Too+Zut Games02/05/26INKS.+State of Play Games06/25/21Iron Marines+Ironhide Irl05/04/23It’s Literally Just MowingProtostar01/10/25Japanese Rural Life AdventureGame Start09/15/23JellyCar WorldsWalaber Entertainment12/09/22Jeopardy! DailyFrosty Pop09/04/25Jeopardy! World Tour+Uken10/06/23Jet DragonGrezzo Co.06/16/23Jetpack Joyride+Halfbrick Studios07/23/21Jetpack Joyride 2Halfbrick Studios08/19/22Jigsaw Puzzle by MobilityWare+MobilityWare06/10/22Junkworld TDIronhide09/22/23Katamari Damacy Rolling LIVEBandai Namco04/03/25Kingdom Rush 5: Alliance TD+Ironhide Irl09/03/25Kingdom Rush Frontiers TD+Ironhide Irl11/12/21Kingdom Rush Vengeance TD+Ironhide Irl07/29/22Kingdom Two Crowns+Raw Fury05/04/23Kingdoms: Merge & BuildCherrypick Games08/18/23Knotwords+Zach Gage11/03/23Legends of Kingdom RushIronhide Game Studio06/11/21LEGO BrawlsThe Lego Group09/19/19LEGO Builder’s JourneyThe Lego Group12/19/19LEGO DUPLO World+StoryToys07/07/23LEGO Friends Heartlake Rush+StoryToys05/01/25LEGO Hill Climb Adventures+Fingersoft06/05/25LEGO Star Wars BattlesTT Games09/24/21LEGO Star Wars: CastawaysGameloft11/19/21Leo’s Fortune+1337 & Senri LLC06/25/21Let’s Go Mightycat!Ponos corporation08/07/25Limbo+Playdead05/04/23Lost in Play+Snapbreak Games06/05/25LumenLykkegaard International02/05/21Madden NFL 27 Arcade EditionElectronic Arts08/06/26MasterChef: Let’s Cook!Tilting Point09/03/21MasterpiecedBorderLeap12/01/23Mini Football LegendsMiniclip.com06/04/26Mini MotorwaysDinosaur Polo Club09/19/19Millionaire Trivia: TV Game+Uken06/30/23MonomalsPicomy11/01/19Monster Train+Good Shepherd Entertainment09/05/24Monument Valley+ustwo games02/02/21Monument Valley 2+ustwo games03/11/22Moonshot – A Journey HomeNoodlecake04/22/22My Bowling 3D+iWare Designs07/01/22My Dear Farm+HyperBeard Inc.02/06/25My Little Pony: Mane MergeGameloft12/16/22My Talking Angela 2+Outfit7 Limited09/08/23My Talking Tom+Outfit7 Limited08/12/22My Talking Tom Friends+Outfit7 Limited09/04/25My Talking Tom 2+Outfit7 Limited06/04/26My Town Home – Family Games+My Town Games05/04/23My Very Hungry CaterpillarStoryToys04/02/26MySimsElectronic Arts11/06/25MySims KingdomElectronic Arts11/06/25NARUTO: Ultimate Ninja Storm+Bandai Namco12/04/25NBA 2K24 Arcade Edition2K Sports10/24/23NBA 2K25 Arcade Edition2K Sports10/03/24NBA 2K26 Arcade Edition2K Sports10/16/25Nekograms+Hungry Sky08/10/23NFL Retro Bowl ’25New Star R&D09/04/24Nick Jr. Replay!Viacom05/07/26Oceanhorn 2: Knights of the Lost RealmCornfox & Bros.09/19/19Oceanhorn 3Cornfox & Bros.03/05/26Octodad: Dadliest Catch+Young Horses05/04/23Oddmar+Mobje Ltd.12/03/21Old Man’s JourneyBroken Rules11/18/22OutlandersPomelo Games09/19/19Outlanders 2Pomelo Games07/03/24Over the AlpsStave Studios09/19/19OverlandFinji09/19/19PAC-MAN Party RoyaleBANDAI NAMCO Entertainment10/18/19PAC-MAN 256+BANDAI NAMCO Entertainment12/05/24PatternedBorderLeap09/19/19Perchang WorldPerchang05/07/26PGA Tour Pro GolfHypGames02/06/25Piano Tiles 2+Koapps03/06/25Piffle+Hipster Whale10/02/25Play-Doh WorldScary Beasties08/07/25Pocket Card Jockey: Ride On!Game Freak01/20/23Pocket City 2+Engaged Labs07/02/26Pocket Love!+HyperBeard03/05/26Potion Punch 2+Monstronauts Inc.01/08/26PowerWash SimulatorFuturLab12/04/25PPKP+Shimada Toshiro05/04/23Pro Darts 2026+iWare Designs05/27/22Pro Snooker & Pool 2026+iWare Designs Ltd.04/15/22Prune+Joel McDonald04/29/22Puffies.Lykkegaard Europe04/03/25Punch Kick Duck+Shaun Coleman07/03/24Puyo Puyo Puzzle PopSega04/04/24Puzzle & Dragons StoryGungHo Online Entertainment12/05/23Rabbids MultiverseUbisoft06/06/24Reigns+Devolver Digital07/01/21Retro Bowl+New Star R&D06/23/23Retro Bowl College+New Star R&D08/06/26Retro Goal+New Star R&D06/23/23RetrocadeResolution Games02/05/26Return to Monkey Island+Devolver06/06/24Ridiculous Fishing EXVlambeer07/17/23Rodeo Stampede+Featherweight Games01/10/25RollerCoaster Tycoon Classic+Atari04/03/25Sago Mini Jinja’s GardenSago Mini01/08/26Sago Mini Trips+Sago Mini04/04/24Samba de Amigo: Party-To-GoSega08/29/23Sesame Street Mecha Builders+StoryToys04/03/25Sid Meier’s Civilization VII2K02/05/26Skate CitySnowman09/19/19Skate City: New YorkSnowman01/10/25Slay the Spire+Humble Bundle07/07/23Smash Hit+Mediocre10/03/24Snake.io+Kooapps05/04/23Sneaky SasquatchRAC709/19/19Solitaire StoriesRed Games Co.07/02/21SongPop PartyGameloft04/02/21Sonic Dash+Sega04/08/22Sonic Dream TeamSega12/05/23Sonic RacingSega09/19/19Sp!ngSMG Studio03/05/21SpaceInvaders InfinityGene EVOTAITO Corporation04/03/25Spades: Card Game+MobilityWare01/07/22Spider Solitaire: Card Game+MobilityWare10/07/22Spire BlastOrbital Knight sp.01/22/21Spongebob SquarePants: Patty PursuitNickelodeon05/28/20Spongebob: Patty Pursuit 2Viacom International12/04/25Squiggle DropNoodlecake01/27/23Star Trek: LegendsTilting Point LLC04/02/21Stardew Valley+ConcernedApe07/21/23Stitch.Lykkegaard Europe10/28/22Subway Surfers+Sybo Games12/04/25Subway Surfers TagSybo Games07/15/22Suika Game+Xgimi Limited09/03/25SUMI SUMI: Matching Puzzle+Imagineer Co.05/01/25Summer Pop!+Ocean Games05/02/24Summon QuestThe Label04/21/23Super Leap DayNitrome08/06/21Super Mega Mini PartyRed Games Co, LLC11/01/19Super Monsters Ate My Condo+PikPok04/04/24Super Stickman Golf 3+Noodlecake08/06/21Taiko no Tatsujin Pop Tap BeatBANDAI NAMCO Entertainment04/02/21Talking Tom Blast ParkOutfit7 Limited12/05/24Tamagotchi Adventure KingdomBandai Namco01/05/24Temple Run+Imangi Studios05/04/23Temple Run LegendsImangi Stuidios08/01/24Temple Run: Puzzle AdventureScopely, Inc.09/17/21Texas Hold’em Poker: Pokerist+KamaGames11/07/24The Battle of Polytopia+Midjiwan03/07/24The Game of Life 2+Marmalade Game Studio04/03/25The Last CampfireHello Games08/27/20The Oregon TrailGameloft04/02/21Thomas and Friends: Let’s Roll+StoryToys10/02/25Three Kingdoms HeroesKoei Tecmo Games01/10/25Time Locker+Sotaro Otsuka05/04/23tint.Lykkegaard International09/19/19Tiny Wings+Andreas Illiger10/15/21TMNT Splintered FateParamount Global05/04/23Trials of Mana+Square Enix01/10/25True Skate+True Axis01/08/26Toca Boca Jr. ClassicsSago Mini11/06/25Tomb of the Mask+Playgendary06/06/24Turmoil+Gamious12/05/23Ultimate 8 Ball Pool+HypGames05/07/26UNO: Arcade EditionMattel06/05/25Unpacking+Humble Bundle04/02/26Vampire Survivors+Poncle08/01/24Very Little Nightmares+Bandai Namco05/04/23Warped Kart RacersElectric Square05/20/22Water Sort Puzzle: Get Color+Tripledot Studios08/06/26What the Car?Triband ApS05/04/23What the Clash?Triband ApS05/01/25What the Golf?Fig09/19/19Wheel of Fortune DailyFrosty Pop11/07/24Where Cards FallSnowman09/19/19Winding WorldsKO_OP05/15/20with My BuddyNeilo inc.05/01/25Words in ProgressGamious02/01/24Words of Wonders: Search+Fugo Bilisim05/01/25Worms Across WorldsTeam 1708/07/25WurdwebAran & Adriaan08/13/21Wylde FlowersStudio Drydock02/22/22Zen Koi Pro+LandShark Games07/03/24Zen Pinball PartyZEN Studios09/03/21Zookeeper WorldKiteretsu Inc.09/10/21

Read more »

MacBook Ultra rumors: Apple’s thinner OLED touchscreen flagship expected late 2026 or early 2027
Apple is reportedly preparing a major overhaul of its high-end laptop lineup, potentially under the new “MacBook Ultra” name. This would sit… The post appeared first on MacDailyNews.

Read more »

iPhone 18 Pro rumor roundup: 2nm A20 chip, C2 modem, under-display Face ID
Apple's iPhone 18 Pro is right around the corner, and the rumor mill started earlier than normal. Here's what you need to know.Apple's iPhone 18 Pro will feature numerous improvements over the iPhone 17 Pro.In 2025, Apple gave its high-end iPhone a major redesign, with the iPhone 17 Pro featuring a distinct pill-shaped camera plateau, an aluminum frame, and a bright orange color option. Inside, the A19 Pro chip bumped up the RAM to 12GB, and the phone even gained a vapor chamber cooling system.With the iPhone 18 Pro, meanwhile, Apple is expected to deliver a more incremental upgrade, with the only noticeable change likely to be on the front of the device. Smaller Dynamic Island aside, it'll be more of the same design-wise. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Let Apple Mail organize your emails for you
With the new automatic mail categorization in Apple Mail, you can organize your emails and keep your inbox less cluttered. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

B&H's $1,349 M5 MacBook Air deal with 24GB RAM ends this weekend
The upgraded M5 MacBook Air has 24GB of memory to boost performance, and it's $150 off this weekend only.Apple's M5 MacBook Air with 24GB of RAM is on sale at B&H - Image credit: AppleB&H's best-selling 13-inch MacBook Air configuration is $150 off as part of the Apple Authorized Reseller's broader M5 MacBook Air sale. What makes this particular model especially appealing is its upgrade to 24GB of RAM.Buy 13" MacBook Air 24GB RAM for $1,349 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple expands retail footprint and financing options to capture surging iPhone demand in India
Apple is intensifying efforts to convert India’s growing appetite for premium smartphones into higher sales by opening more retail stores… The post appeared first on MacDailyNews.

Read more »

App Store Rejection of the Week: Dark Hours
https://blog.terrygodier.com/2026/08/07/browsers-have-standards-the-app.html

Read more »

Apple memory supplier bets on AI boom lasting till 2029 with $38B investment
One of Apple's memory suppliers is making a massive investment to expand chip production amid global shortages, but it won't make your next iPhone any cheaper.Apple supplier SK hynix invests $38B in AI memory — Image credit: SK HynixOn Friday, SK hynix announced that it has approved a 54 trillion won ($38.3 billion) investment to build two new semiconductor fabrication plants in South Korea.The investment includes 35.2 trillion won ($24 billion) towards the Yongin Y2 facility, which will produce high-bandwidth memory (HBM) and next-generation DRAM products. Construction will begin in 2027 and wrap up by 2029. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

9to5Mac Daily: August 7, 2026 – iPhone Fold hype, macOS updates
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Backblaze: Backup you can rely on. Save 20% with code 9to5daily.

Read more »

Apple faces iPhone 18 Pro DRAM shortage weeks before launch
An iPhone 18 Pro DRAM shortage reportedly leaves $1 billion worth of Apple chips stuck at TSMC, threatening tight supply at launch. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

MacBook Pro users will soon have two compelling new upgrade options
Apple is rumored to give MacBook Pro users two very different new models to choose from this fall: an M6 MacBook Pro and an all-new MacBook Ultra. Here’s what’s coming.

Read more »

Apple seems to have abandoned Cinematic mode, and that’s a mistake
When Apple unveiled the iPhone 13 back in 2021, it made a huge deal over a headline new feature, Cinematic mode. This is the video equivalent of Portrait mode, allowing you to select a focus point and blur the background. Portrait mode has improved dramatically in successive generations, but the same cannot be said of Cinematic mode. The company appears to have completely lost interest in the feature, and although that’s understandable in one way, I would argue it’s a big mistake …

Read more »

Apple expands refurb store with rare M5 MacBook Pro configs, Apple TV 4K, more
Apple has added a host of new products to its official Certified Refurbished Store this week. New M5 MacBook Pro models, the Studio Display XDR, high-end M5 MacBook Air configurations, and more are available.

Read more »

M6 MacBook Pro rumor roundup: Faster chip, familiar design
The upcoming M6 MacBook Pro promises enhanced performance in a time-tested design. Here's what to expect... including the price. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Canadian Man Pleads Guilty in Snowflake Extortions
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

Read more »

Vulnerability Summary for the Week of July 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info @fastify/rate-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option. 2026-07-29 7.3 CVE-2026-15144 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54661 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54662 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54664 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54666 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2. 2026-07-29 7.4 CVE-2026-54660 acowebs--Dynamic Pricing With Discount Rules for WooCommerce Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce = 1.4.0-beta.27 through = 1.7.0-beta.0 through sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() - > smc_release() - > smc_conn_free() - > smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn- >rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done. 2026-07-27 9.8 CVE-2026-64541 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk- >skb- >data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb- >tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded. The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace. 2026-07-27 9.1 CVE-2026-64551 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE- >element_id and pIE- >length are read without checking that i + sizeof(*pIE) data + 12, which requires pIE- >length >= 16. For WLAN_EID_RSN it compares pIE- >data + 8, requiring pIE- >length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE- >length minimum, matching the pattern established in update_beacon_info(). 2026-07-27 8.1 CVE-2026-64536 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet- >packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected. 2026-07-27 8.1 CVE-2026-64540 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb- >data[packet_len] before the skb- >len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb- >len before reading. 2026-07-27 8.1 CVE-2026-64547 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check before the allocation. 2026-07-27 8.4 CVE-2026-64548 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page- >private into skb_shinfo()- >frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. 2026-07-27 8.4 CVE-2026-64552 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt 2026-07-27 8.8 CVE-2026-64554 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler. Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM. 2026-07-27 8.8 CVE-2026-64555 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)- >chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the - >new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied. 2026-07-29 8.8 CVE-2026-64557 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. 2026-07-27 7.8 CVE-2026-64531 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e- >view.data_off))`, where e- >view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e- >size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" () which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks. 2026-07-27 7.8 CVE-2026-64532 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp- >vcn, &dp0- >vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp- >lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts] 2026-07-27 7.8 CVE-2026-64533 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv- >adv_data, adv- >adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path. 2026-07-27 7.8 CVE-2026-64539 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b- >disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b- >disc in RX softirq under rcu_read_lock() (tipc_udp_recv - > tipc_rcv - > tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. 2026-07-27 7.8 CVE-2026-64543 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master- >flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master- >flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up. 2026-07-27 7.5 CVE-2026-64545 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile- >topology_id[7] without checking block- >num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) 2026-07-27 7.1 CVE-2026-64546 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb- >len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header. 2026-07-27 7.3 CVE-2026-64550 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context. 2026-07-29 7.8 CVE-2026-64556 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer. 2026-07-29 7.8 CVE-2026-64558 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size. 2026-07-29 7.8 CVE-2026-64559 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader- >sighand = NULL; unlock(sighand); (p- >sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p- >signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p- >sighand = NULL; sh = lock_task_sighand(p) sighand = p- >sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p- >sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated--- 2026-07-29 7.8 CVE-2026-64560 litestar-org--litestar Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0. 2026-07-28 8.1 CVE-2026-48060 magepeopleteam--Booking and Rental Manager Unauthenticated Other Vulnerability Type in Booking and Rental Manager by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0. 2026-07-28 7.5 CVE-2026-61609 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3. 2026-07-31 9.9 CVE-2026-52855 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0. 2026-07-31 7.5 CVE-2026-52856 QuantumCloud--Simple Link Directory Pro Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro 'post'`, any author-level user who has authored a `wwp_requests` post - such as one created via the wholesale registration form - can access this nonce and submit the role-assignment request. 2026-07-29 8.8 CVE-2026-12144 savonrb--savon Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2. 2026-07-31 8.1 CVE-2026-53510 Sender--Sender Newsletter, SMS and Email Marketing Automation for WooCommerce Administrator SQL Injection in Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce subscribe() callback after it had already called params- >notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params- >subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp - > att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths. 2026-07-31 7.6 CVE-2026-10685 zephyrproject--zephyr The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads. 2026-08-02 7 CVE-2026-10848 zip-lib--zip-lib Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction. 2026-07-28 7.5 CVE-2026-17524 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 100plugins--Open User Map Contributor Cross Site Scripting (XSS) in Open User Map prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data. 2026-07-28 6.5 CVE-2026-6251 chrisvrichardson--MapPress Maps for WordPress Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query. 2026-08-01 6.5 CVE-2026-6453 CyberTimon--RapidRAW RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels. 2026-07-30 6.5 CVE-2026-64816 DaveGamble--cJSON cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-67216 DaveGamble--cJSON cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. 2026-07-29 5.3 CVE-2026-67217 davejesch--Database Collation Fix The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy. 2026-08-01 5.3 CVE-2026-15018 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 6.5 CVE-2026-45377 decidim--decidim Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2. 2026-07-31 5.4 CVE-2026-45086 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 5.5 CVE-2026-45376 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant's ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 4.9 CVE-2026-45330 deveasel--Demi One Click Demo Import, Backup & Site Migration The Demi - One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. 2026-07-28 5.3 CVE-2026-15012 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows - including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records - whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage. 2026-07-28 4.3 CVE-2026-16797 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 4.9 CVE-2026-16811 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. 2026-07-30 5.9 CVE-2026-16971 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. 2026-07-30 5.9 CVE-2026-18362 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. 2026-07-30 4.2 CVE-2026-16970 dotonpaper--Pinpoint Booking System Version 2 The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. 2026-08-01 4.9 CVE-2026-15403 drakkan--SFTPGo SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. 2026-07-30 4.2 CVE-2026-10031 edge22--GenerateBlocks The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute. 2026-08-01 6.4 CVE-2026-13458 eLyiN--gemini-bridge gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1. 2026-07-31 6.2 CVE-2026-54785 facturadorvirtual--Facturacin Electrnica Costa Rica The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-07-29 4.3 CVE-2026-9720 Flipper Code--WP Maps Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. 2026-07-31 4.3 CVE-2026-28144 foomagoo--Plugin Organizer The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15304 Franky--Events Made Easy Unauthenticated Broken Access Control in Events Made Easy prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15267 Themeisle--Feedzy Contributor Server Side Request Forgery (SSRF) in Feedzy

Read more »

Read This Before You Buy That TV Streaming Stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.

Read more »

LG to Ban Residential Proxies from Smart TV Apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG's webOS store allow unknown third-parties to route their Internet traffic through a user's TV.

Read more »

Microsoft Patches a Record 570 Security Flaws
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

Read more »

Lessons Learned from CISA’s Recent GitHub Leak
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.

Read more »

iPads continue to be on sale for $50 off Apple’s MSRP, prices start at $399
Amazon continues to have 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP, starting at $399. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $499 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $699 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

These Excellent iPhone 17e Deals Are Still Available at Total Wireless and Metro
Total Wireless and Metro by T-Mobile are still offering two of the better iPhone 17e promotions available today. One focuses on $0/month financing, while the other delivers one of the lowest upfront prices you'll find without a trade-in. See Total Wireless iPhone Deals See Metro by T-Mobile iPhone Deals For the latest prices from all major wireless carriers, see our iPhone Price Tracker.

Read more »

Select Apple Watch Ultra 3 models on sale for $100 off MSRP, now $699
Amazon is now offering the Apple Watch Ultra 3 for $699, a $100 discount from Apple’s $799 MSRP and the lowest price currently available among major Apple retailers. This is a solid opportunity for buyers who were waiting for a price drop. The Ultra line is designed for durability, long battery life, and advanced fitness and outdoor features, making it a strong option for more active users. View the deal here at Amazon, and compare all Apple Watch prices on our Apple Watch Price Tracker, updated daily.

Read more »

Amazon Continues $400-$500 Off 16-Inch M5 Max MacBook Pro Models, Lowest Prices Available
Amazon continues to offer substantial discounts on both standard 16-inch M5 Max MacBook Pro configurations. The 36GB/2TB model is currently $400 below Apple's MSRP, while the higher-end 48GB/2TB version is discounted by $500. The larger $500 discount applies to the flagship 48GB/2TB configuration, while the 36GB/2TB model is currently available at a $400 savings. Both discounts represent some of the lowest prices currently available on these professional-grade MacBook Pro configurations. Amazon is also offering fast shipping on available inventory, making this an attractive opportunity for buyers who have been waiting for lower pricing on Apple's most powerful notebook models. For the latest prices and availability, visit our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Sunday Sale: Amazon Cuts $500 Off 14-Inch M5 Max MacBook Pro with 36GB RAM and 2TB SSD
Amazon has discounted Apple's 14-inch MacBook Pro with an M5 Max chip, 36GB of unified memory, and a 2TB SSD by $500. The configuration is currently available below Apple's MSRP, making it one of the better values we've found on the high-end 14-inch MacBook Pro lineup. Shop the deal at Amazon. The M5 Max version is designed for demanding professional workloads, including video editing, software development, AI projects, 3D rendering, and other graphics-intensive applications. With 36GB of unified memory and a spacious 2TB SSD, it also offers plenty of room for large files and creative projects. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on one of Apple's most powerful 14-inch notebooks while the discount remains available. For the latest MacBook Pro prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon Takes $100 Off 15-Inch M5 MacBook Air Models
Amazon has discounted all three standard configurations of Apple's 15-inch M5 MacBook Air by $100, giving shoppers the opportunity to save on the entire lineup. Whether you're looking for the base model or need additional memory and storage, every standard configuration is currently available below Apple's MSRP at Amazon. The sale includes the 16GB/512GB, 16GB/1TB, and 24GB/1TB models, each priced $100 below Apple's retail pricing. Shop the 16GB/512GB model, the 16GB/1TB model, or the 24GB/1TB model at Amazon. Amazon is also offering fast shipping on available inventory, making it easy to lock in today's pricing while supplies last. For the latest MacBook Air prices, availability, and deals, visit our 15" MacBook Air Price Tracker, updated daily.

Read more »

Today’s AirPods Deals: AirPods Pro 3 $50 off, AirPods Max 2 $100 off at Amazon
Amazon's latest sale is delivering good AirPods prices, with discounts available across Apple's entire AirPods lineup. AirPods 4 are currently $99, AirPods 4 with ANC are $144.99, AirPods Pro 3 have dropped to $199, and AirPods Max 2 are now $449. Shop Amazon's AirPods deals here. The biggest discounts are available on AirPods Pro 3 and AirPods Max 2, which are currently selling for $50 and $100 below Apple's MSRP, respectively.Note that pricing can change quickly. For the latest sales and deals, see our AirPods Price Tracker, updated daily.

Read more »

Amazon continues to offer $30 discount on Apple Watch SE 3 models, prices start at $219
Amazon has Apple Watch SE 3 models on sale for $30 off MSRP, shipping included: - 40mm Apple Watch SE GPS: $219, $30 off MSRP - 44mm Apple Watch SE GPS: $249, $30 off MSRP - 40mm Apple Watch SE GPS + 5G: $249, $30 off MSRP - 44mm Apple Watch SE GPS + 5G: $299, $30 off MSRP These are the lowest sale prices currently available for Apple Watch SE 3 models. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Sunday Sale: Amazon Takes $100 Off Apple’s 13-Inch M5 MacBook Air Lineup
Amazon has discounted all three standard configurations of Apple's 13-inch M5 MacBook Air by $100, making this one of the best opportunities to save on the entire lineup. Whether you're shopping for the entry-level model or need additional storage, every standard configuration is currently available below Apple's MSRP at Amazon. The sale includes the 16GB/256GB, 16GB/512GB, and 24GB/512GB models, each priced $100 below Apple's retail pricing. Shop the 16GB/512GB model, the 16GB/1TB model, or the 24GB/1TB model at Amazon. Amazon is also offering fast shipping on available inventory, making it easy to lock in today's pricing while supplies last. For the latest MacBook Air prices, availability, and deals, visit our 13" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Discounts Standard 16-Inch M5 Pro MacBook Pro Models by Up to $300
Amazon is offering solid discounts on two of Apple's standard 16-inch M5 Pro MacBook Pro configurations. The 24GB RAM/1TB SSD model is currently $240 below Apple's MSRP at $2759.99, while the upgraded 48GB RAM/1TB SSD version is discounted by $300 to $3299. Shop the 24GB model or shop the 48GB model at Amazon. Both Space Black and Silver models are available at the same sale prices, giving buyers the flexibility to choose their preferred finish without paying a premium. These are currently among the best prices available on Apple's standard 16-inch M5 Pro lineup. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on a new MacBook Pro while the discounts remain available. For the latest prices, availability, and deals, visit our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon Cuts $300 Off 14-Inch M5 Max MacBook Pro with 36GB RAM and 2TB SSD
Amazon has discounted Apple's 14-inch MacBook Pro with an M5 Max chip, 36GB of unified memory, and a 2TB SSD by $300. The configuration is currently available below Apple's MSRP, making it one of the better values we've found on the high-end 14-inch MacBook Pro lineup. Shop the deal at Amazon. The M5 Max version is designed for demanding professional workloads, including video editing, software development, AI projects, 3D rendering, and other graphics-intensive applications. With 36GB of unified memory and a spacious 2TB SSD, it also offers plenty of room for large files and creative projects. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on one of Apple's most powerful 14-inch notebooks while the discount remains available. For the latest MacBook Pro prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.

Read more »

iPads on sale starting at $399, $50 off Apple’s MSRP
Amazon has 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP, starting at $399. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $499 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $699 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »