Amazon's $399 Samsung M8 USB-C monitor deal ends today
The $300 discount on the 32-inch M8 4K display ends tonight, with the monitor arriving by Christmas.Get a Samsung M8 monitor for $399 today only - Image credit: SamsungYou can pick up the Samsung M8 Smart Monitor for $399.99 at your choice of Amazon and B&H Photo, with Amazon stating its deal ends tonight. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Ottocast launches new CarPlay AI Box plus wireless adapter with rear cabin monitoring [Sponsored]
If you’ve been looking to upgrade your car’s tech without breaking the bank on a new vehicle, Ottocast just dropped two products worth checking out. The OttoAibox P3 Pro brings AI voice control and Android apps to your existing CarPlay setup, while the Cabin Care adapter adds wireless CarPlay plus a rear-seat camera for keeping an eye on the little ones. Both are designed to work with what you’ve already got installed, which is pretty much the whole point. more…

Read more »

Hands-on with Anker’s new 20,100mAh battery bank: 220W output, compact design
Anker is back at it again with a new 20,100mAh power bank, under its Anker Prime brand. This power bank has three ports, offers up to 220W of output, and comes in a pretty compact package. It’s available for purchase on Amazon for $129. more…

Read more »

Bizarre iOS 26 bug causes some Android camera photos to turn red in iPhone Photos app
Users have been noticing a weird iPhone bug with some pictures they have saved in their Photos app on iOS 26; sometimes, photos taken from Android phones are being imported into the Photos with a seemingly intense red color filter applied. What’s even stranger is this red haze only shows when you actually tap on an image in Photos and zoom in. The preview thumbnails preserve their full color so if you are just scrolling through your library, you might not see anything wrong. Luckily, this bug has a simple fix you can do to put each picture back to how it was … more…

Read more »

Today in Apple history: iMac Pro packs potent all-in-one punch
On December 14, 2016, Apple releases the iMac Pro. Despite a beautiful design, the professional-grade desktop was only a placeholder. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Apple Watch Series 11 vs Apple Watch SE 3: Which should you buy this holiday season?
Apple updated its entire lineup of Apple Watch models this year, introducing the Apple Watch SE 3, Apple Watch Series 11, and Apple Ultra 3. If you’re shopping for someone or buying for yourself this holiday season, here’s what you need to know about Apple Watch SE 3 vs Apple Watch Series 11. Plus, you can currently save $200 on the Apple Watch Series 11 for holiday shopping. more…

Read more »

iOS 26.2: All the new features now available on your iPhone
After several weeks of beta testing, iOS 26.2 is now available for all iPhone users. The update brings new features for Apple Podcasts and Apple Music, more Liquid Glass design updates, and more. Head below for our full guide on all the new iOS 26.2 features. more…

Read more »

Foxconn is building a massive factory in KY, but probably not for Apple
Foxconn is investing $174 million into a new facility in Louisville, Kentucky, but nothing points to it becoming part of Apple's supply chain.A Foxconn factory signApple supply chain partner Foxconn is making moves to expand its footprint in the United States again. This time, it's building up its operations in Kentucky.Announcements from Louisville Mayor Craig Greenberg and Kentucky Governor Andy Beshear confirmed that Foxconn will be opening "it's first U.S. manufacturing operation" in Louisville. The investment, which is claimed to be worth about $174 million, will potentially create 180 new jobs in the region. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

X for iOS finally offers widgets, five years after first teasing them
X for iOS has finally rolled out widgets for your Home Screen and Lock Screen. more…

Read more »

X for iOS finally offers widgets, five years after first teasing them
X for iOS has finally rolled out widgets for your Home Screen and Lock Screen. more…

Read more »

X for iOS finally offers widgets, five years after first teasing them
X for iOS has finally rolled out widgets for your Home Screen and Lock Screen. more…

Read more »

Crime blotter: Protesters arrested outside NYC Apple Store on Black Friday
Multiple iPhone theft rings are busted in Canada, India, and Cambodia, CBP has embraced Cellebrite, and an on-camera arrest in California is all in this week's Apple Crime Blotter.The Fifth Avenue Apple Store The latest in an occasional AppleInsider series, looking at the world of Apple-related crime. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

One of the only private AI assistants just lowered the price for a lifetime license to $79
Macworld TL;DR: Pansophy is a private AI assistant, and it’s only $79 for life right now. OpenAI just lost the lawsuit to keep its chat logs private. If you don’t like the idea of your company secrets and personal conversations being vulnerable, it’s time to pivot to a private AI assistant like Pansophy. This new AI desktop assistant can write emails, generate code, summarize research, and a lot more. And right now, it’s only $79 for a lifetime subscription (reg. $199). Once Pansophy is installed, you can bounce between writing tasks, coding questions, document summaries, or general brainstorming without hitting usage caps or waiting for tokens to refresh. You don’t even need WiFi. It works anywhere your laptop works, which makes it feel surprisingly freeing if you’re used to cloud tools. Anyone who writes, studies, builds, or manages projects will find something useful here. Students can drop PDFs in and get clear summaries. Developers can debug or write small scripts without leaving their desktop. Writers and business owners get a quiet, local space to think through ideas without wondering where their data goes. The multilingual support is a nice bonus, especially if you work in more than one language or switch contexts a lot. You can keep everything local, still get smart responses, and avoid yet another subscription climbing in price. During this limited-time sale, it’s only $79 to get a Pansophy Private Personal AI Desktop Assistant lifetime subscription. Pansophy Private Personal AI Desktop Assistant – Base Plan: Lifetime SubscriptionSee Deal StackSocial prices subject to change.

Read more »

Indie App Spotlight: ‘Headlines’ offers a news reading experience that isn’t tiring
Welcome to Indie App Spotlight. This is a weekly 9to5Mac series where we showcase the latest apps in the indie app world. If you’re a developer and would like your app featured, get in contact. Keeping up with the news can often be exhausting. Headlines offers a clean experience that puts your favorite writers and publications front and center. It’s available on iPhone, iPad, and has a web app. more…

Read more »

Walmart's $74 AirPods 4 deal makes last-minute holiday shopping a breeze
Walmart's $74 AirPods 4 deal delivers the lowest price available, with Amazon sold out of the popular holiday gift idea.Pick up a last-minute holiday gift with Walmart's $74 AirPods 4 deal.Save $55 on Apple AirPods 4 at Walmart, bringing the price down to just $74 this weekend. This is within $5 of the lowest AirPods 4 price to date, making it a great time to pick up a holiday gift or a treat for yourself.Buy AirPods 4 for $74 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple TV: How to watch ‘A Charlie Brown Christmas’ for free this weekend
As it did with ‘A Charlie Brown Thanksgiving‘ a few weeks ago, Apple is streaming ‘A Charlie Brown Christmas‘ for free on Apple TV this Saturday (13) and Sunday (14). Here’s how to watch. more…

Read more »

Locked out: How a gift card purchase destroyed an Apple account
The locking of an Apple Account and the difficulty one loyal Apple customer has experienced in regaining access is a stark reminder to be vigilant when buying gift cards for the holidays.A selection of Apple Gift Card designs - Image Credit: AppleWhile holiday presents tend to involve physical items or cash, gift cards are often included in the mix, especially as a last-minute purchase. However, as one prominent Apple user has discovered, sometimes buying a gift card can be hazardous, even if they take a lot of precautions.Posted on Saturday, Paris Buttfield-Addison of game studio Secret Lab explains how access to their entire Apple digital life has been blocked off. All stemming from an Apple Gift Card purchase. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple Wallet order tracking improved with iOS 26, but it’s still missing something
With iOS 26 this year, Apple announced an incredibly promising improvement to the order tracking feature in the Wallet app. With on-device Apple Intelligence models, the company planned to identify orders in your email to provide tracking updates, eliminating the need for retailers to need to support their proprietary feature. I was really optimistic about this improvement, but after using it for the past couple months, it honestly feels a dull band-aid solution that never should’ve been implemented. Here’s why. more…

Read more »

Today in Apple history: AirPods arrive to conquer the audio world
On December 13, 2016, Apple finally launched the original AirPods after months of delay. The wireless earbuds became an instant hit. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Score a lifetime of guitar lessons with real-time feedback for just $250
Give the guitarist in your life (or yourself) lifetime access to JustinGuitar, unlocking lessons, real-time feedback and thousands of songs. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Leak teases iOS 26.4 feature updates alongside iOS 27, iOS 28 plans
A leaked internal iOS 26 build allegedly includes references to a new Health app, more accurate AirPods tracking in iOS 26.4, and even some details about iOS 27 and iOS 28.A leak may have revealed Apple's intended changes for iOS's future updatesApple often tests many features due in future software updates well in advance of their eventual release. One recent leak may have hinted at what's coming in the 28-generation of Apple's operating systems.The internal build of iOS 26 examined by MacWorld is said to include several "flags" for features Apple is still working on. The flags are designed to allow engineers to enable and disable features while they are being developed, and often include notes about the feature itself. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple @ Work: It is time for Apple TV to get PoE and finally reach its enterprise potential
Apple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. I believe that the Apple TV is one of Apple’s most underrated products in the enterprise and retail. For IT teams it is a surprisingly powerful tool for conference rooms, retail displays, training spaces, and digital signage. It is easy to manage remotely, incredibly stable, and fits right into the same device management and deployment workflows that IT teams already use for Macs, iPads, and iPhones. For the price, you get a lot of capability. Yet Apple TV still has not reached its full potential inside the enterprise because it is missing one thing that would make it dramatically easier to deploy at scale: Power over Ethernet. more…

Read more »

2025 tech gift guide for Apple users — personally tested and recommended
It’s officially time to start checking gifts off your list before it’s too late. For my 2025 tech gift guide, I’m recommending technology products that I’ve actually used all year. Each of these products has been especially useful this year, and they’ll make great gifts for the Apple users in your life. more…

Read more »

Beats Powerbeats Pro 2 is $50 Off
Amazon has the Beats Powerbeats Pro 2 marked $50 off.  The Powerbeats Pro 2 is powered by an H2 chip designed by Apple for crisp and immersive audio. It is the first earbuds by the company to feature wireless Qi charging along with up to 45 hours of playback, even with a charging case that’s […] The post appeared first on iLounge.

Read more »

Shazam Rolling Out New Feature ‘Popular Segments’
Shazam will be introducing a feature called ‘Popular Segments’ that shows a song track’s specific part that has gained the most popularity among its listeners. An example was given where the 30-35 second mark of a track was the key moment of the song, whereas most listeners asked for it to be identified by Shazam. […] The post appeared first on iLounge.

Read more »

Budget-Friendly Bundles Coming To YouTube TV Next Year
YouTube announced that YouTube TV is going to be revamped with over 10 TV packages that are specific to genres next year, and it will be budget-friendly compared to the current YouTube TV version we have, which has a subscription price set at $82.99 monthly. Packages for family, news, entertainment, sports, and other genres will […] The post appeared first on iLounge.

Read more »

New Firmware For AirPods Pro 2 and 3 Released
The AirPods Pro 2 and AirPods Pro 3 have received a new firmware. For the AirPods Pro 2, it is now 8B28 from the previous 8B21, while the AirPods 3 is now 8B30 from the old firmware, 8B25. No information was given on what came with the updates. The AirPods Pro 2 and Pro 3 […] The post appeared first on iLounge.

Read more »

The Beats Studio Buds+ is $20 Off
Amazon has the Beats Studio Buds+ marked $20 off. The earbuds features an industry-leading wireless connection with Class 1 Bluetooth with fewer chances of dropouts and an extended range, so you can listen to music or podcasts even if your device is not as close to you. You get up to 36 hours of use […] The post appeared first on iLounge.

Read more »

iOS 26 Code Hints New Features of AirTag 2
A couple of new features will reportedly be coming to the AirTag 2, which are focused on improving its capabilities for tracking. The new AirTag will have a feature called ‘Improved Moving’ that would let users locate the AirTag precisely, even when it is on the move. Another feature aims to improve tracking when you […] The post appeared first on iLounge.

Read more »

12th-gen iPad May Be Powered by A19 Chip Used in the iPhone 17
Macworld reports that they have discovered a document containing Apple’s internal code suggesting that the iPad 12, an upcoming budget-friendly iPad, will be equipped with the A19 chip that the company used for the iPhone 17. Past reports were based on a document showing that the device will be powered by an A18 chip. This […] The post appeared first on iLounge.

Read more »

Computer Virus Protection Tips and How to Remove a Virus from Your Computer
Computer viruses continue to be a widespread and costly problem, affecting everyone from casual computer users to major organizations. Some of the most damaging incidents in history started with small actions that could have happened to anyone. The Melissa virus spread in 1999 because thousands of people opened what looked like a normal email attachment. […] The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, December 2025 Edition
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Read more »

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill
A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia's war against Ukraine.

Read more »

SMS Phishers Pivot to Points, Taxes, Fake Retailers
China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

Read more »

Vulnerability Summary for the Week of November 24, 2025
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info 0x4m4--HexStrike AI By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server's normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025). 2025-11-30 9.1 CVE-2025-35028 https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011  AMD--AMD Prof Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. 2025-11-24 7.1 CVE-2025-48510 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. 2025-11-24 8 CVE-2025-52538 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability 2025-11-24 7.3 CVE-2025-0003 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service. 2025-11-24 7.3 CVE-2025-0005 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability. 2025-11-24 7.3 CVE-2025-52539 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  ASR--Lapwing_Linux Out-of-bounds Read vulnerability in ASR1903ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26. 2025-11-26 7.4 CVE-2025-13735 https://www.asrmicro.com/en/goods/psirt?cid=41  blubrry--PowerPress Podcasting plugin by Blubrry The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2025-11-27 8.8 CVE-2025-13536 https://www.wordfence.com/threat-intel/vulnerabilities/id/d420ee49-e7b3-43d8-a263-8a93abd1133c?source=cvehttps://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3068https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3012https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L2368https://plugins.trac.wordpress.org/changeset/3402635/  Chanjet--CRM A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2025-11-30 7.3 CVE-2025-13788 VDB-333792 | Chanjet CRM upgradeattribute.php sql injectionVDB-333792 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #690084 | Chanjet CRM V1.0 SQL Injectionhttps://github.com/Bellingham-max/CVE/issues/1  code-projects--COVID Tracking System A vulnerability was detected in code-projects COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument code results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. 2025-11-24 7.3 CVE-2025-13585 VDB-333349 | code-projects COVID Tracking System login.php sql injectionVDB-333349 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699840 | code-projects COVID Tracking System V1.0 SQL Injectionhttps://github.com/beamyou/CVE/issues/4https://code-projects.org/  code-projects--Jonnys Liquor A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. 2025-11-24 7.3 CVE-2025-13582 VDB-333346 | code-projects Jonnys Liquor GET Parameter detail.php sql injectionVDB-333346 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699554 | code-projects Jonnys Liquor 1.0 /detail.php SQL injectionhttps://github.com/rassec2/dbcve/issues/5https://code-projects.org/  code-projects--Library System A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2025-11-24 7.3 CVE-2025-13578 VDB-333342 | code-projects Library System Login index.php sql injectionVDB-333342 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699536 | code-projects Library System 1.0 index.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/4https://code-projects.org/  code-projects--Question Paper Generator A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. 2025-11-24 7.3 CVE-2025-13583 VDB-333347 | code-projects Question Paper Generator POST Parameter signupscript.php sql injectionVDB-333347 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699591 | code-projects question paper 1.0 /signupscript.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/6https://code-projects.org/  cursor--cursor Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution. 2025-11-26 9.8 CVE-2025-62354 https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/  Dassault Systmes--DELMIA Service Process Engineer A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10555 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10555  Dassault Systmes--ENOVIA Product Manager A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10554 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10554  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. 2025-11-27 9.8 CVE-2025-13675 https://www.wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user- >set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. 2025-11-27 8.8 CVE-2025-13680 https://www.wordfence.com/threat-intel/vulnerabilities/id/645f60ad-c8e5-47ec-94f1-960de4ef7838?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  Eaton--Eaton Galileo Software Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. 2025-11-27 7.3 CVE-2025-59890 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1024.pdf  Elated Themes--FindAll Listing The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin. 2025-11-27 9.8 CVE-2025-13538 https://www.wordfence.com/threat-intel/vulnerabilities/id/14981949-271c-4f98-a6a1-b00619f1436d?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  Elated Themes--FindAll Membership The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email. 2025-11-27 9.8 CVE-2025-13539 https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  factionsecurity--faction FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction's extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1. 2025-11-26 9.7 CVE-2025-66022 https://github.com/factionsecurity/faction/security/advisories/GHSA-xr72-2g43-586whttps://github.com/factionsecurity/faction/commit/c6389f1c76175b7c1c68d1a87b389311b16c62c3  fugue-project--fugue Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server. The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. This issue has been patched via commit 6f25326. 2025-11-25 8.8 CVE-2025-62703 https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0  geoserver--geoserver GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0. 2025-11-25 8.2 CVE-2025-58360 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525https://osgeo-org.atlassian.net/browse/GEOS-11682  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads. 2025-11-26 7.5 CVE-2025-12571 GitLab Issue #579168HackerOne Bug Bounty Report #3362239  GL-Inet--GL-AXT1800 A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. 2025-11-24 8.3 CVE-2025-44018 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230  HCL Software--iNotes HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. 2025-11-25 8.1 CVE-2025-0248 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032  Huawei--HarmonyOS Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. 2025-11-28 9.3 CVE-2025-64314 https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8.4 CVE-2025-58302 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 8.4 CVE-2025-58303 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8 CVE-2025-58310 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. 2025-11-28 7.3 CVE-2025-58308 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 7.3 CVE-2025-58316 https://consumer.huawei.com/en/support/bulletin/2025/11/  Janitza--UMG 96-PA An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. 2025-11-24 7.5 CVE-2025-41729 https://certvde.com/de/advisories/VDE-2025-094  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0. 2025-11-29 7.1 CVE-2025-53896 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-23h2-3jj8-58hm  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0. 2025-11-29 7.2 CVE-2025-53899 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5  Logpoint--SIEM An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability. 2025-11-27 8.5 CVE-2025-66359 https://servicedesk.logpoint.com/hc/en-us/articles/29158899698333-XSS-Vulnerability-due-to-insufficient-input-validation  Mattermost--Mattermost Mattermost versions 10.12.x

Read more »

Cybersecurity Best Practices: Essential Tips for Modern Mac Security
Cybersecurity affects every person who uses a device, connects to the internet, pays bills online, or stores important files digitally. The rise of cloud services, mobile apps, and complex online accounts has created new opportunities for criminals to target individuals. Mac users benefit from strong built-in protections, but threats now focus less on operating systems […] The post appeared first on The Mac Security Blog.

Read more »

What Is a Network Security Key? How to Find Your Wi-Fi Password on Any Device
If you have ever tried connecting a new phone, laptop, tablet, or smart home device to your Wi-Fi network, you have likely been asked for something called a network security key. The name sounds technical, but it simply refers to the password that protects your wireless network. Understanding what a network security key is, how […] The post appeared first on The Mac Security Blog.

Read more »

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself "Scattered LAPSUS$ Hunters" made headlines regularly this year by stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for "Rey," the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Read more »

Is Your Android TV Streaming Box Part of a Botnet?
On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user's network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers.

Read more »

Vulnerability Summary for the Week of November 17, 2025
High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Patch Info ABB–ABB Ability Edgenius Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. 2025-11-20 9.6 CVE-2025-10571 https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch  AMD–AMD StoreMI A DLL hijacking vulnerability in AMD StoreMIâ„¢ could allow an attacker to […]

Read more »

Cloud Security Tips: How to Protect Your Data in the Cloud
Cloud storage has become woven into the way people save, share, and collaborate on files. From personal photos to business documents, the cloud makes information easy to access from nearly any device. Yet this convenience can also create security risks. If an attacker gains access to a cloud account, they may be able to view […] The post appeared first on The Mac Security Blog.

Read more »

Sunday Holiday Sale: Take $200-$250 off M4 MacBook Airs, prices start at only $749
Amazon has all 13" M4 MacBook Airs and 15" M4 MacBook Airs on Holiday sale for $200-$250 off Apple's MSRP, starting at only $749. Be sure to select Amazon as the seller, rather than a third-party: - 13" M4 MacBook Air (16GB/256GB): $749, $250 off - 13" M4 MacBook Air (16GB/512GB): $949, $250 off - 13" M4 MacBook Air (24GB/512GB): $1149, $250 off - 15" M4 MacBook Air (16GB/256GB): $999, $200 off - 15" M4 MacBook Air (16GB/512GB): $1199, $200 off - 15" M4 MacBook Air (24GB/512GB/): $1399, $200 off Their prices are the lowest available for new M4 MacBook Airs anywhere and represent one of the best Holiday deals on Apple products available right now. For the latest sales & prices, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, both updated daily.

Read more »

Holiday Sale: M4 Mac minis available starting at only $479
Amazon has M4 and M4 Pro Mac minis on Holiday sale starting at only $479 and ranging up to $120 off MSRP. Shipping is free: - Mac mini M4 (16GB/256GB): $479, $120 off MSRP - Mac mini M4 (16GB/512GB): $699, $100 off MSRP - Mac mini M4 (24GB/512GB): $923, $26 off MSRP - Mac mini M4 Pro (24GB/512GB): $1287, $112 off MSRP These are the lowest Holiday sale prices currently available on Mac minis. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Walmart if offering a $100 Apple Watch Series 11 Holiday discount this weekend
Walmart is now offering a $100 online discount on new Apple Watch Series 11 models as part of their Holiday sales. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 42mm Apple Watch Series 11 GPS: $299, save $100 - 46mm Apple Watch Series 11 GPS: $329, save $100 - 42mm Apple Watch Series 11 GPS + 5G: $399, save $100 - 46mm Apple Watch Series 11 GPS + 5G: $429, save $100 These are the lowest Holiday sale prices available for Apple Watch Series 11 models. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Apple Watch SE 3 on sale this weekend for $50 off MSRP, prices start at $199
Walmart has Apple Watch SE 3 models on sale on their online store for $50 off MSRP as part of their ongoing Holiday savings. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 40mm Apple Watch SE GPS: $199, $50 off MSRP - 44mm Apple Watch SE GPS: $229, $50 off MSRP - 40mm Apple Watch SE GPS + 5G: $249, $50 off MSRP - 44mm Apple Watch SE GPS + 5G: $279, $50 off MSRP These are the lowest Holiday prices available for Apple Watch SE 3 models. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

AirPods Pro 3 on Holiday Sale for $50 off Apple’s MSRP, now only $199
Amazon has Apple AirPods Pro 3 on Holiday sale for $50 off MSRP, including free shipping: - AirPods Pro 3: $199, $50 off Their price is the lowest we've seen so far for these new AirPods Pro models. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Holiday Sale: 24-inch iMacs for $150-$170 off MSRP
Amazon has Apple's 24-inch M4 iMacs on Holiday sale for $150-$170 off MSRP, starting at $1149, each including free shipping: - 24-inch M4 iMac (8-Core CPU, 16GB RAM, 256GB SSD): $1149, $150 off MSRP - 24-inch M4 iMac (10-Core CPU, 16GB RAM, 256GB SSD): $1349, $150 off MSRP - 24-inch M4 iMac (10-Core CPU, 16GB RAM, 512GB SSD): $1549, $150 off MSRP - 24-inch M4 iMac (8-Core CPU, 24GB RAM, 512GB SSD): $1729-1749, $150-$170 off MSRP Amazon's prices are the lowest available for one of these new iMacs. Note that stock can vary. Price posted above is the lowest price available for each standard configuration, regardless of color. For the latest prices and deals, see our iMac Price Tracker, updated daily.

Read more »

Holiday Sale: Apple 11-inch M3 iPads for $100-$50 off MSRP
Take $100-$50 off 11-inch M3 iPad Airs at Amazon as part of their ongoing Holiday sale. Shipping is free: - 11" 128GB WiFi M3 iPad Air: $499, $100 off MSRP - 11" 256GB WiFi M3 iPad Air: $599, $100 off MSRP - 11" 512GB WiFi M3 iPad Air: $824.99, $75 off MSRP - 11" 1TB WiFi M3 iPad Air: $1049, $50 off MSRP Be sure to order from Amazon itself rather than a third-party seller. These are the lowest prices currently available for new 11" M3-powered iPad Airs. For the latest prices & sales, keep an eye on our iPad Air Price Tracker, updated daily.

Read more »

27-inch 5K Studio Displays back in stock and on Holiday sale starting at $1368, up to $231 off MSRP
Amazon has Apple Studio Displays (Standard Glass) back in stock and on Holiday sale starting at $1368, up to $231 off MSRP. Shipping is free: - Studio Display (Tilt Adjustable): $1368 $231 off MSRP - Studio Display (Tilt & Height Adjustable): $1849 $150 off MSRP Their prices are the lowest available for Studio Displays among the retailers we track, and $1368 is the lowest price we've seen for a new Studio Display for the past few months. For the latest prices and sales, see our Studio Display Price Tracker, updated daily.

Read more »

2nd generation Apple HomePods on sale for $20 off MSRP with free 1-2 day shipping
B&H Photo has Apple's 2nd generation full-size HomePods (White or Midnight) on sale for $20 off MSRP. This is the steepest discount available on 2nd-gen HomePods among the Apple retailers we track. In addition, B&H offers free 1-2 day shipping on these models to most US addresses: - HomePod (White): $279, save $20 - HomePod (Midnight): $279, save $20 See our HomePod Price Tracker for the latest prices and deals from Apple and its resellers.

Read more »

Update: Apple’s new 14-inch M5 MacBook Pros on Holiday sale again for $250 off MSRP, prices start at $1349
Amazon is now offering $250 discounts on new 14" M5 MacBook Pros as part of their Holiday sales, each including free shipping: - 14" M5 MacBook Pro (16GB/512GB/Black): $1349, MSRP $1599 - 14" M5 MacBook Pro (16GB/512GB/Silver): $1349, MSRP $1599 - 14" M5 MacBook Pro (16GB/1TB/Black): $1549, MSRP $1799 - 14" M5 MacBook Pro (16GB/1TB/Silver): $1599.00, MSRP $1799 - 14" M5 MacBook Pro (24GB/1TB/Black): $1749, MSRP $1999 - 14" M5 MacBook Pro (24GB/1TB/Silver): $1749, MSRP $1999 These are the lowest prices available for new M5 MacBook Pros right now. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

The latest AirPods Holiday sales: Take $80 off AirPods 4 w/ANC, $30 off AirPods Pro 3
Amazon has Apple AirPods 4 with ANC and AirPods Pro 3 on Holiday sale for up to $80 off MSRP, including free shipping: - AirPods 4 with ANC: $99.99, $80 off - AirPods Pro 3: $219.99, $30 off These are currently the lowest Holiday sale prices available for these AirPods models. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Lowest Holiday Sale Price Alert! Apple Watch Series 11 models for $100 off MSRP
Amazon is now offering a $100 discount on new Apple Watch Series 11 models as part of their Holiday sales. Shipping is free: - 42mm Apple Watch Series 11 GPS: $299, save $100 - 46mm Apple Watch Series 11 GPS: $329, save $100 - 42mm Apple Watch Series 11 GPS + 5G: $399, save $100 - 46mm Apple Watch Series 11 GPS + 5G: $429, save $100 These are the lowest prices available for Apple Watch Series 11 models. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »