News

Morgan Wandell Leaving As Apple TV Head Of International Development

After nearly a decade at Apple TV, Morgan Wandell is departing as Head of International Development, reports Deadline. He will remain focused on the growing international television market with the launch of his own production company, Kismet. Wandell started at...

Apple’s MacBook Neo shipping delays are finally starting to improve

Apple’s MacBook Neo shipping delays are finally starting to improve as reports suggest Apple increased A18 Pro chip orders to keep up with demand for the laptop, reports The MacObserver. At the beginning of May, delivery estimates for several MacBook Neo...

More MacTech News

Opinion

Analyst predicts features of the iPhone 17, iPhone 18, and iPhone 19

Talk about a powerful crystal ball! In a new Medium post, analyst Ming-Chi Kuo offers his predictions for the iPhone 17, iPhone 18, and iPhone 19 that will likely arrive in 2025, 2026, and 2027. He says the high-end iPhone 17 model is expected to feature an upgraded...

More Opinion

Scanners

Thursday May 14
52 minutes ago
Pay once, scan forever—iScanner App lifetime access is $25 today | Macworld
Pay once, scan forever—iScanner App lifetime access is $25 today
Macworld TL;DR: The iScanner App turns your iPhone, iPad, or Android device into a powerful all-in-one PDF scanner for a one-time $24.97 payment (MSRP $199.90). It takes a special kind of person to figure out how to scan a document using three random apps, a Notes workaround, and pure determination. But no one should have to. Right now, the iScanner App Lifetime Subscription is available for a one-time $24.97 (reg. $199.90), and it feels like one of those life-altering productivity purchases that you wish you’d done sooner. iScanner turns your phone into a surprisingly legit portable document station. You can scan receipts, contracts, IDs, handwritten notes, books, forms, business paperwork, and more. The app automatically detects document borders, straightens pages, removes shadows and weird lighting, and converts files into PDFs, JPGs, DOCs, XLS files, PowerPoints, and more. It also includes OCR text recognition in 20+ languages, which means scanned documents become searchable and editable instead of trapped forever as blurry photo files. And because this is more than a basic scanner app, you also get built-in editing tools, e-signatures, watermarking, password protection, and more directly from your phone. There’s even a math-solving mode and automatic object-counting feature, which feels slightly unnecessary until the exact moment you need it. Don’t miss grabbing lifetime access to iScanner for a one-time $24.97 (reg. $199.90). iScanner App: Lifetime SubscriptionSee Deal StackSocial prices subject to change.
Read more »
1 hour ago
Macworld Podcast: iOS 26.5 new features, Apple Watch rumors | Macworld
Macworld Podcast: iOS 26.5 new features, Apple Watch rumors
Macworld xOS 26.5 is now available. What are the new features? Plus, we talk about Apple Watch rumors in this episode of the Macworld Podcast. This is episode 983 with Michael Simon, Jason Cross, and Roman Loyola. Watch episode 983 on YouTube Listen to episode 983 on Apple Podcasts
Read more »
02:49 am
Apple TV renews ‘Margo’s Got Money Troubles’ for season 2 ahead of next week’s finale | 9 to 5 Mac
Apple TV renews ‘Margo’s Got Money Troubles’ for season 2 ahead of next week’s finale
Following a strong first season with critics and viewers alike, Apple has confirmed that ‘Margo’s Got Money Troubles’ will return for season two. Here are the details. more…
Read more »
02:49 am
Apple TV renews ‘Margo’s Got Money Troubles’ for season 2 ahead of next week’s finale | 9 to 5 Mac
Apple TV renews ‘Margo’s Got Money Troubles’ for season 2 ahead of next week’s finale
Following a strong first season with critics and viewers alike, Apple has confirmed that ‘Margo’s Got Money Troubles’ will return for season two. Here are the details. more…
Read more »
01:51 am
Safari 26.5 fixes WebKit bugs that could crash Safari or expose user data | 9 to 5 Mac
Safari 26.5 fixes WebKit bugs that could crash Safari or expose user data
Apple has published the full list of security fixes for Safari 26.5, including a WebKit vulnerability that could let maliciously crafted web content disclose sensitive user information. Here are the details. more…
Read more »
12:24 am
Apple Extends Notification Privacy Fix to iOS 15, iOS 16, and iPadOS 17 | TidBITS
Apple Extends Notification Privacy Fix to iOS 15, iOS 16, and iPadOS 17
If your iPhone or iPad is too old to run iOS 18 or later, Apple hasn’t forgotten you—new updates for iOS 15, iOS 16, and iPadOS 17 patch the notification retention flaw that could expose deleted messages.
Read more »
12:19 am
Apple counters US smartphone decline as iPhone sales grow: report | 9 to 5 Mac
Apple counters US smartphone decline as iPhone sales grow: report
According to Counterpoint Research, Apple outperformed the broader US smartphone market in Q1, helped by continued iPhone 17 demand amid weakening Android sales. Here are the details. more…
Read more »
12:11 am
Apple finally found a fix for the M4 Mac mini’s infamous power button | Cult of Mac
Apple finally found a fix for the M4 Mac mini’s infamous power button
macOS 26.5 Tahoe brings a new option that lets you start the Mac mini without touching the power button. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
12:00 am
Siri and Apple Home can control Matic vacuum/mop, here’s how | 9 to 5 Mac
Siri and Apple Home can control Matic vacuum/mop, here’s how
I’ve been using a robot vacuum and mop from Matic Robots for several months now. It’s a solid product with Apple-level build quality that’s built on privacy and intelligence. While Apple Home integration wasn’t always a feature, I was pleased to see support arrive recently. more…
Read more »
Wednesday May 13
10:39 pm
LaCie 8Big Pro5 review: Gargantuan capacity and Thunderbolt 5 speed | Macworld
LaCie 8Big Pro5 review: Gargantuan capacity and Thunderbolt 5 speed
Macworld At a glance Pros Massive capacity RAID 0, 1, 5 Up to 2.8GBps sequential throughput Cons Large and heavy Nearly $6000 (32TB) and up Our Verdict Price When Reviewed This value will show the geolocated pricing text for product undefined Best Pricing Today SSD’s are expensive. What are the 8Big Pro5’s features? To be honest, I miss the old silver drawers and huge blue power button of older LaCie drives. Neil Poulon still does a lot of LaCie’s styling but there was no claim for that as regards the 8Big Pro5. It’s good-looking to be sure, and there is a blue button (much smaller) — it’s just not the conversation starter the old Bigs were. How much does the 8Big Pro5 cost? As configured with 32TB (eight 4TB HDDs), the 8Big Pro5 costs a rather hefty $5,979, or six grand in the vernacular. With 64TB, it’s $7249, with 128TB – $8969, and with 192TB – $11,269. There’s also a 256TB version listed, but it wasn’t for sale yet and no price was provided. To be frank, the 32TB price is a bit disappointing, especially as eight 4TB Barracuda drives are only $1200. {Check when you have the box what the drives inside are} Far faster 8TB NVMe SSDs run around $1300 at the moment, so a much faster four-disk, 32TB NVMe array would be a couple hundred dollars less once you factor in an enclosure. Note that there are external 8TB USB SSDs available for only $900 at the moment. You could combine these with software RAID for an ad hoc array, though it’s a bit of a kludge. After you get into the larger capacities, however, the fiscal math starts to work heavily in the 8Big Pro5’s favor. Multiply the $5400 SSD price for 64TB and 128TB and your talking about thousands of dollars more for the next three tiers. I do wish the unit was available unpopulated for those that have a surplus of HDDs sitting around, or want to use cheaper drives. How fast is the 8Big Pro5? How fast the 8Big Pro5 is depends on the RAID mode you run it in. At it’s absolute fastest with all eight drives striped in RAID 0, it’s around 2.8GBps. We’ve seen Thunderbolt 5 SSDs nearly touch 7GBps so it’s apparent you’re still dealing with hard drives. Should I buy the 8Big Pro5? In my humble opinion, the 8Big Pro5 — which admittedly is a very classy piece of storage kit — only makes financial sense at 64TB and greater capacity. The greater the capacity, the more sense it makes. At 32TB you can go cheaper and far faster. Still, kudos to Seagate for a tk.
Read more »
10:34 pm
Color.io acquisition offers more proof Apple is focusing on creatives again | Cult of Mac
Color.io acquisition offers more proof Apple is focusing on creatives again
Apple's acquisition of Color.io could be a part of its larger effort to rebuild the creative software ecosystem it once dominated. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
10:22 pm
Apple warns EU against forcing Google to open Android to AI rivals | 9 to 5 Mac
Apple warns EU against forcing Google to open Android to AI rivals
Apple submitted a filing to the European Commission today criticizing proposed measures that would force Google to open parts of Android to rival AI services. Here are the details. more…
Read more »
09:45 pm
Morgan Wandell leaving as Apple TV head of international development | Mac Daily News
Morgan Wandell leaving as Apple TV head of international development
After nearly a decade at Apple TV, Morgan Wandell is departing as Head of International Development. He will remain focused on the… The post appeared first on MacDailyNews.
Read more »
09:22 pm
Apple Ads is courting developers through a newly formed ‘Emerging Team’ | 9 to 5 Mac
Apple Ads is courting developers through a newly formed ‘Emerging Team’
Members of a newly formed Emerging Team are reaching out to developers as Apple looks to increase Apple Ads spending. Here are the details. more…
Read more »
08:33 pm
WhatsApp now lets you have incognito conversations with Meta AI | 9 to 5 Mac
WhatsApp now lets you have incognito conversations with Meta AI
WhatsApp and the Meta AI app now let users turn on incognito mode when having sensitive conversations with Meta AI. Here’s what that means and how to use it. more…
Read more »
08:24 pm
Apple shares hit new all-time intraday and closing highs | Mac Daily News
Apple shares hit new all-time intraday and closing highs
In Nasdaq trading today, shares of Apple Inc. rose to hit a new all-time closing high. Apple’s all-time intraday high was also set today… The post appeared first on MacDailyNews.
Read more »
08:23 pm
iPhone Ultra is coming: Six new features in Apple’s high-end model | 9 to 5 Mac
iPhone Ultra is coming: Six new features in Apple’s high-end model
Apple’s first foldable iPhone is coming this fall, and rumors say it will be called iPhone Ultra. Here are six features to expect from Apple’s new high-end iPhone Ultra. more…
Read more »
07:58 pm
Netflix says that ads will start appearing in more parts of its app | 9 to 5 Mac
Netflix says that ads will start appearing in more parts of its app
Netflix keeps getting more expensive, and that’s pushing more users to its ad tier. Today alongside touting booming ad-tier subscriptions, Netflix also announced that ads will be expanding to more places in its app. more…
Read more »
07:57 pm
Apple TV sees another departure from its international content team | 9 to 5 Mac
Apple TV sees another departure from its international content team
Just weeks after Oliver Jones left Apple TV for Amazon, another executive focused on international content is leaving the company. Here are the details. more…
Read more »
07:56 pm
Strava’s iPhone app now works with Apple’s new AirPods Pro 3 fitness feature | 9 to 5 Mac
Strava’s iPhone app now works with Apple’s new AirPods Pro 3 fitness feature
Starting today, Strava users can now log workouts and tap into the latest AirPods Pro 3 workout feature. Strava says it works as a standalone AirPods experience or alongside Apple Watch. more…
Read more »
07:30 pm
Kevin Warsh confirmed as next Chair of the U.S. Federal Reserve | Mac Daily News
Kevin Warsh confirmed as next Chair of the U.S. Federal Reserve
The U.S. Senate confirmed Kevin Warsh as Chairman of the Federal Reserve Board of Governors, succeeding Jerome Powell whose term ends Friday… The post appeared first on MacDailyNews.
Read more »
07:30 pm
Anthropic’s latest Claude release turns your Mac into a small business powerhouse | 9 to 5 Mac
Anthropic’s latest Claude release turns your Mac into a small business powerhouse
If you run a small business from your Mac, you’ll want to pay attention to Anthropic’s latest Claude release. more…
Read more »
07:25 pm
iOS 27’s new design leak sounds a lot like what I’ve been wanting most | 9 to 5 Mac
iOS 27’s new design leak sounds a lot like what I’ve been wanting most
Yesterday Mark Gurman at Bloomberg published an extensive report covering design changes for iOS 27 overall, with lots of specifics on the new Siri and upgraded Camera app. One of my favorite details could be good news for the Liquid Glass change I’ve been wanting most. more…
Read more »
07:05 pm
Flash deal: Grab Apple's M4 MacBook Air for just $829 | AppleInsider
Flash deal: Grab Apple's M4 MacBook Air for just $829
B&H is blowing out M4 MacBook Air inventory with prices as low as $829. But supply is limited for this flash deal.Grab B&H's blowout MacBook Air deal now through May 15 - Image credit: AppleThe $829 blowout special applies to the closeout M4 13-inch MacBook Air with an 8-core GPU, 16GB of unified memory, and 256GB of storage when ordered in the Sky Blue finish.Buy M4 MacBook Air for $829 Continue Reading on AppleInsider | Discuss on our Forums
Read more »
07:00 pm
Apple explores AI agent integration in the App Store: A potential game-changer for the platform era | Mac Daily News
Apple explores AI agent integration in the App Store: A potential game-changer for the platform era
Apple is actively exploring ways to welcome third-party AI agents into the App Store, according to a new report… The post appeared first on MacDailyNews.
Read more »
06:51 pm
Apple TV Head Of International Development jumping ship to start his own production company | AppleInsider
Apple TV Head Of International Development jumping ship to start his own production company
Morgan Wandell, who has been with Apple TV since before its launch, is now departing the streaming service in favor of launching his own production company.Apple TV logoIn 2017, Apple poached Wandell from Amazon Studios to join its team at Apple Worldwide Video. When Apple TV launched in 2019, his title became Head of International Content Development.While at Apple, Wandell developed and oversaw production of "Monarch: Legacy of Monsters," "Tehran," "Disclaimer," "Masters of the Air," and "The New Look." Continue Reading on AppleInsider | Discuss on our Forums
Read more »
06:30 pm
Apple wants apps to integrate with Siri in iOS 27, but one fear holds some back: report | 9 to 5 Mac
Apple wants apps to integrate with Siri in iOS 27, but one fear holds some back: report
Apple’s major Siri overhaul will be unveiled on June 8, and the company is reportedly already working with developers to get apps integrated, but it’s facing concerns over a key point: money. more…
Read more »
06:20 pm
Despite risks, Apple seeks ways to bring more AI to the App Store | AppleInsider
Despite risks, Apple seeks ways to bring more AI to the App Store
Apple is facing the problem of allowing apps that use AI agents in the App Store, and is having internal discussions about how to incorporate them without breaking long-standing App Store guidelines.The App Store includes a lot of AI-coded apps, but Apple is still wary of loosening the leash. Artificial intelligence has led to a swathe of apps hitting the App Store, as developers embrace agentic coding. While Apple is fine with using AI to produce apps, it continues to have trouble bringing apps using AI to the App Store itself, due to the potential of breaking its rules.Apple is now trying to work out how to include apps that use AI agents in the App Store so that it can profit from them, reports sources of The Information. Continue Reading on AppleInsider | Discuss on our Forums
Read more »
06:11 pm
Apple stock breaks $300, on track for record close | Mac Daily News
Apple stock breaks $300, on track for record close
Apple stock climbed sharply on Wednesday, rising nearly 2% intraday to approach the $300 mark and positioning the stock for a potential… The post appeared first on MacDailyNews.
Read more »
06:09 pm
This $19 Ugreen Uno robot is the cutest way to power your iPhone or MacBook Neo | Macworld
This $19 Ugreen Uno robot is the cutest way to power your iPhone or MacBook Neo
Macworld Ugreen Uno 30W Charger View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Maybe I’ve been looking at dull chargers for too long, but this robot-shaped charger is my new bestie. And you can get one too. Not only is this Ugreen Uno charger the absolutely cutest thing out there, but it can be yours for $19 right now, the best price we’ve seen since early January. Just think how cute this thing will look while it charges your gadgets. There’s a USB-C port on the very top of the charger, so that’s where you can plug in your cable. The robot looks like it’s wearing headphones, so the port is right in the “band.” The charger prongs are hidden in the robot’s little boots, which you’ll have to take off when you want to plug it in. Those tiny magnetic shoes will protect the plugs when you’re traveling around, while the LCD screen will display a little face that will let you know whether your device hsa finished charging. The Ugreen Uno charger delivers 30W of charging, so it’s more than enough to handle your iPhone, AirPods, or your Apple Watch, and even a MacBook Neo in a pinch. So get one of these uber cute Ugreen Uno chargers for $19 while it’s still on sale. There are other color options available, too, if you’d rather not get it in black.
Read more »

Older posts

Wednesday May 13
11:15 pm
Ads Aren't in the Apple Maps App Yet, But They're Coming Soon | MacRumors
Ads Aren't in the Apple Maps App Yet, But They're Coming Soon
Apple released iOS 26.5 yesterday with a new Suggested Places feature in the Apple Maps app, which is a precursor to the ads that Apple plans to start showing later this year. There was some confusion over whether ads are live, but as of now, the ‌Apple Maps‌ app still doesn't have ads. Apple did start laying the groundwork for ads in iOS 26.5 and tested a splash screen, but no ads appeared during the beta testing period or after launch. When Apple announced plans to bring ads to the Maps app in March, it said that ads will be implemented in the United States and Canada "this summer." Astronomical summer in the Northern Hemisphere starts on June 21 and ends on September 22. Meteorologically, summer begins on June 1 and lasts through August, so depending on Apple's definition of summer, we'll get ads in Maps sometime between June 1 and September 22. Ads will be displayed in ‌Apple Maps‌ search results and in the new Suggested Places section added in iOS 26.5. Suggested Places shows recommendations based on what's trending nearby and a user's recent searches. There will be ads in the Maps app on iPhone and iPad, and they will be clearly marked with an "Ad" label, similar to how ads appear in App Store search results. Businesses will bid for ad placement, and the highest bidder for a keyword or search term will have its ad shown in search. Apple says that location data and the ads that users see and interact with in the Maps app are not associated with an Apple account, and data is not shared with third parties. There is no opt-out for location-based or personalized ads in Suggested Places.Tags: Apple Ads, Apple MapsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
09:48 pm
Apple Grew U.S. iPhone Sales While Broader Smartphone Market Declined in Q1 | MacRumors
Apple Grew U.S. iPhone Sales While Broader Smartphone Market Declined in Q1
Apple's smartphone sales increased 1.3 percent year-over-year in the United States during the first quarter of 2026, according to data shared by Counterpoint Research. Apple saw a sales increase while the broader U.S. smartphone market experienced a 5.7 percent decline during the same time period. Android device sales declined 14.4 percent, while Apple's market share grew 4 percent year-over-year. iPhone 17 performance is part of the reason Apple outperformed the market, but Counterpoint says the company was also helped by a later launch of Samsung's Galaxy S26 series in March. Apple's market share increased at all three major U.S. carriers, while Android saw a decline. The iPhone made up 75 percent of sales at Verizon, AT&T, and T-Mobile, while Android devices made up 25 percent. Counterpoint expects Apple to continue to draw users to iOS because it maintained pricing with the iPhone 17e and even increased storage, while smartphone makers with slimmer hardware margins have had to raise prices. If Apple can avoid significant price increases and continue to outpace its peers in promotional dollars, it will be tough for Android OEMs to keep up in the year ahead. During Apple's April 30 earnings call, CEO Tim Cook said the ‌iPhone 17‌ family was the most popular lineup in Apple's history. Cook said information from IDC indicated Apple gained market share during the quarter. Cook also said iPhone demand was off the charts, leading to supply constraints during the quarter. Apple was having trouble getting the A19 and A19 Pro chips manufactured by TSMC due to demand for TSMC's AI server chips. According to Cook, memory shortages and rising costs will have more of an impact on Apple later in 2026. Apple is expecting "significantly higher" memory costs and plans to look at a "range of options" for mitigation. Cook declined to provide insight into how Apple plans to deal with the problem, and he did not comment on whether Apple will raise prices.Tag: CounterpointThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
08:23 pm
Meta AI App Gets 'Incognito Chat' as OpenAI Faces Lawsuits Over Stored Chat Logs | MacRumors
Meta AI App Gets 'Incognito Chat' as OpenAI Faces Lawsuits Over Stored Chat Logs
The Meta AI app and Meta AI on WhatsApp have a new "incognito chat" option, which Meta CEO Mark Zuckerberg said is a "completely private way to interact with AI." Zuckerberg also said that Meta AI's incognito mode is the first major AI product where there is no log of conversations stored on servers. Zuckerberg likened the feature to end-to-end encryption, and said no one will be able to read the AI conversations, not even Meta or WhatsApp. AI inference for incognito chat is done in a Trusted Execution Environment that Zuckerberg said is not accessible to Meta. Conversations also disappear from the phone when exiting a chat session, and nothing is saved or logged. Web searches are conducted privately, with no search information linked to the user. "To get the most from personal superintelligence, we'll all need ways to discuss sensitive topics in ways that no one else can access," Zuckerberg said. WhatsApp head Will Cathcart told reporters that the AI has safety guardrails, and it will refuse to answer questions that could be interpreted as harmful or illegal, steering conversations in a different direction. The mode also only supports text, and users are unable to upload images. Incognito chat for Meta AI comes as OpenAI is facing a lawsuit for allegedly causing a teen's drug overdose. The teen asked ChatGPT for information on whether it was safe to take two drugs together, and was provided with an incorrect answer that led to his death. OpenAI has been sued several times by the families of people who used ChatGPT before dying by suicide. Lawsuits against OpenAI have involved chat logs recovered by the plaintiffs, and without those logs, there would be far less evidence for a legal complaint over AI actions and advice. Google and OpenAI also offer temporary chat options, but messages are still stored on remote servers. Google keeps data for up to three days, and OpenAI keeps logs for 30 days. Meta's private chat option is rolling out in the coming months in the Meta AI app and WhatsApp.Tags: Meta, OpenAI, WhatsAppThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
07:51 pm
Samsung Set to Beat Apple to AI Smart Glasses With July Launch | MacRumors
Samsung Set to Beat Apple to AI Smart Glasses With July Launch
Samsung is planning a Galaxy Unpacked event for July, and the company plans to introduce new foldable smartphones and AI "Galaxy Glasses," according to Seoul Economic Daily. Samsung's event will take place on July 22, so it will debut new Galaxy Z Fold8 and Z Flip8 foldable smartphones just weeks ahead of when Apple's first foldable iPhone is introduced, plus it will beat Apple to AI glasses. Apple has been racing to develop its own smart glasses to compete with the Meta Ray-Ban AI glasses, but rumors suggest Apple won't launch the glasses until 2027. There is a chance Apple will preview the glasses in 2026, but there's no certainty yet. Samsung is working with eyewear company Gentle Monster for its AI glasses, and the wearable will run Google's Android XR operating system with Gemini integration. The glasses will feature a high-definition camera, speakers, and a microphone, similar to the Meta Ray-Bans, and there will be no built-in display. AI integration will be a main selling point, with Gemini able to use video captured by the wearer to answer queries. Samsung will link the glasses to Galaxy smartphones and its SmartThings home appliance ecosystem. The glasses that Samsung is working on sound similar to everything rumored for Apple's own AI glasses. Apple's glasses will rely on Siri, and will include cameras to feed visual information to the AI. Speakers and microphones will be included, but no display is expected for the first version. Samsung is also planning for a Fold Wide, or a foldable smartphone that's similar to the dimensions that Apple plans to use for its foldable iPhone. Samsung's foldables to date have been taller than they are wide, but Apple is planning for a wider, iPad-like 4:5 aspect ratio. After Samsung's event, Apple will unveil its next smartphones at its traditional September event. Dates are not known at this time.Tag: SamsungThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:32 pm
Meta Launches 'Instants' App for Sharing Disappearing Photos on Instagram | MacRumors
Meta Launches 'Instants' App for Sharing Disappearing Photos on Instagram
Meta today announced the launch of Instants, a new image sharing option on the Instagram social network. Instants are ephemeral photos that disappear from Instagram after they're viewed by a user's friends or after a 24-hour period. Reactions and replies to Instants images show up in DMs instead of on the post. Instants photos are only displayed for a short period, but they are saved to a user's archive for a year and can be reshared to Stories. Instants cannot be edited, with no option for filters, stickers, or modifications beyond captions. That sets them apart from Stories, which is already an Instagram feature. Instants is an Instagram feature, but Meta has also developed a standalone Instants companion app "for quicker camera access." The standalone app is a direct competitor to Snapchat, the original ephemeral image social network. The new app can be used for sharing Instants, but on Instagram, users can also share Instants from a new camera option in the Direct Messages section of the app. Instants can be viewed on Instagram by opening up DMs and tapping on the new Instants box in the bottom right corner of the inbox. Photos can be shared with friends set as close friends, or as mutuals, aka followers that an Instagram user follows back. Instants are not able to be screenshotted or screen recorded, providing privacy features not available with other Instagram image types. Meta says that Instants are designed for casual, everyday photos. The standalone app is limited to select countries, as Meta says that it is an experiment. Images shared on the Instants app will show up for friends on Instagram, and images shared on Instagram will show up in the Instants app. Instants on Instagram is available globally starting today, and the app is also available for download in countries where it is supported.Tags: Instagram, Meta, PhotosThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:02 pm
Apple Working on Plan to Allow AI Agent Apps on the App Store | MacRumors
Apple Working on Plan to Allow AI Agent Apps on the App Store
Apple is looking into ways to better support apps that include AI agents and AI coding capabilities in the App Store, reports The Information. Apple is designing a system that would maintain its security and privacy standards while allowing for AI app features, but details on how the system will work are unavailable. Apple started blocking updates for some popular vibe coding apps in March because those apps violated ‌App Store‌ rules that prohibit apps from executing code that alters their own functionality or that of other apps. Vibe coding apps let users build apps and websites with little to no coding experience, using AI agents and natural language prompts. Vibe coding has become popular, and Apple's rules have not been able to keep up. Apps that include AI agents present similar problems for Apple. AI agents can autonomously complete complex actions and make mini apps using tools and capabilities that would not traditionally be supported under Apple's ‌App Store‌ rules. Apple will need to make changes to keep up with the software trends that developers and users want. Apple wants to incorporate AI agents into the ‌App Store‌ while preventing some of the issues that people have run into with rogue AI agents deleting content and causing other problems. As it works to prepare for future AI apps, Apple is also developing its own AI capabilities. Siri is set to get a major overhaul in iOS 27, making it smarter and better able to compete with Claude and ChatGPT. Apple has partnered with Google to use custom Gemini models to power ‌Siri‌. The Information says Apple has started contacting app developers to integrate app capabilities like booking flights and sending calendar invites into the new version of ‌Siri‌ and Apple Intelligence. Some developers are hesitant to work with Apple to integrate their apps into ‌Siri‌ because they are worried about providing new ways for Apple to collect commissions. Apple is telling some developers that it does not plan to charge commissions during the early stages of the partnership, but that fees are a possibility in the future. Apple has held talks with Baidu, Alibaba, and Tencent about ‌Siri‌ integration in ‌iOS 27‌, but the companies do not want to end up paying fees to Apple. Apple also plans to allow users to select from multiple chatbots to use with ‌Siri‌, instead of limiting people to OpenAI's ChatGPT. AI models from companies like Anthropic or Google could be used for Image Playground and Writing Tools the way ChatGPT can be used today. It is not clear if Apple plans to open up more of iOS to third-party chatbots, but OpenAI has reportedly been disappointed with Apple's limitations. ChatGPT can be used to generate images and text through the iOS integration, but it cannot access user emails or other personal information. Customers are also rarely using the functionality, according to The Information. Apple's new version of ‌Siri‌ is expected to be unveiled at the WWDC keynote on June 8, and the plans that Apple has for agentic AI apps in the ‌App Store‌ could also be discussed at the same time.Related Roundup: iOS 27Tags: App Store, The InformationThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:38 pm
New Study Highlights Advantages of $549 Windows Laptop Over MacBook Neo | MacRumors
New Study Highlights Advantages of $549 Windows Laptop Over MacBook Neo
Microsoft has responded to the MacBook Neo by commissioning a study that highlights advantages of some Windows laptops. Market research firm Signal65 evaluated four Windows laptops:Lenovo's IdeaPad Slim 3x Lenovo's Yoga 7i HP's OmniBook 5 HP's OmniBook X FlipWith a starting price of $549.99 on Best Buy's online store in the U.S. at the time of this writing, the IdeaPad Slim 3x is the only laptop in the study that currently rivals the MacBook Neo's starting price of $499 (college students) to $599 (general public). The other three laptops currently start at $749 to $1,029 at Best Buy. Signal65 outlined some of the IdeaPad Slim 3x's advantages over the MacBook Neo: Feature IdeaPad Slim 3x MacBook Neo Display Size 15.3-inch 13-inch CPU Snapdragon X1 with "90% faster" multi-core Cinebench 2026 score A18 Pro Base RAM 16GB 8GB Fingerprint Scanner Included Touch ID limited to $699 model Ports 1× USB-C, 2× USB-A, SD, and HDMI 2× USB-C only Wi-Fi Wi-Fi 7 Wi-Fi 6E Backlit Keyboard Yes No Touch Screen Yes No In addition, the IdeaPad Slim 3x achieved longer battery life (16 hours and 29 minutes) compared to the MacBook Neo (13 hours and 28 minutes) in a Tom's Guide test, with Lenovo able to fit a larger battery inside a 15-inch laptop. The study indicated that the IdeaPad Slim 3x has 512GB of storage, but the $549.99 base model has a 256GB SSD, which matches the MacBook Neo. Through June 30, Microsoft is offering U.S. college students a free one-year Microsoft 365 Premium subscription, a free one-year Xbox Game Pass Ultimate subscription, and a free Xbox controller with the purchase of a qualifying Windows laptop, including the IdeaPad Slim 3x. The bundle has a value of more than $500. On the other hand, the MacBook Neo has some advantages over the IdeaPad Slim 3x: Feature MacBook Neo IdeaPad Slim 3x Display Resolution 2,408×1,506 pixels (Retina quality) 1,920×1,200 pixels Display Brightness 500 nits 300 nits Build Material Fully aluminum enclosure Mix of aluminum and plastic Webcam 1080p camera 720p camera Moreover, many reviewers indicated that the MacBook Neo has a superior trackpad and speakers compared to Windows laptops within the same price range. Plus, the MacBook Neo runs macOS instead of Windows, so it benefits from Apple's tight hardware and software integration and features that work across multiple Apple devices. While it is unsurprising that this Microsoft-backed study is focused on promoting Windows laptops, the reality is that the MacBook Neo and the IdeaPad Slim 3x both have pros and cons. More competition in the affordable laptop market is a win overall.Related Roundup: MacBook NeoTags: Lenovo, Microsoft, WindowsBuyer's Guide: MacBook Neo (Buy Now)Related Forum: MacBook NeoThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:08 pm
Apple Defends Google Against EU Proposal to Give AI Rivals Access to Services | MacRumors
Apple Defends Google Against EU Proposal to Give AI Rivals Access to Services
Apple has stepped in to warn that EU proposals to force Google to open Android to competing AI services pose serious risks to user privacy, security, and safety. Apple's latest submission to the EU comes (via Reuters) in response to the European Commission's call for feedback on draft measures designed to help Google comply with the Digital Markets Act (DMA). The proposals would allow competing AI services to interact with Android apps to perform actions such as sending emails, ordering food, or sharing photos. Google has already pushed back on the plans, arguing they would undermine key privacy and security safeguards for European users. Apple, which is itself now subject to EU measures requiring it to open up its own ecosystem, said it has a strong interest in the case given its own operating systems for iPhone, iPad, and Mac. In its submission, Apple said the draft measures "raise urgent and serious concerns," warning that if confirmed, "they would create profound risks for user privacy, security, and safety as well as device integrity and performance." Apple also took aim at the rapidly evolving state of AI as a particular source of concern, arguing that risks are "especially acute in the context of rapidly evolving AI systems whose capabilities, behaviours, and threat vectors remain unpredictable." The company questioned the EU's technical expertise in drawing up the proposals, stating that the Commission is "substituting judgments made by Google's engineers for its own judgment based on less than three months of work," and suggesting the only discernible goal of the draft measures is "open and unfettered access." Apple has a long history of clashing with EU regulators over the DMA. The company challenged the regulation in court in October 2025, and urged regulators to scrap it entirely the month before, arguing it had created security vulnerabilities and worsened the user experience. The EU said it had no intention of repealing the law in response. The feedback period for the proposals ran from April 27 to May 13, 2026. The European Commission has said it will carefully assess all submissions and may adjust the proposed measures as a result, though its final decision must be adopted within six months of the opening of the specification proceedings, giving a deadline of July 27, 2026. The EU separately concluded in May 2026 that the DMA has had a positive impact overall, setting aside Apple's lobbying for the regulation to be revised.Tags: Europe, European Commission, European Union, Google, ReutersThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Notepad++ Mac Port Renamed Nextpad++ After Trademark Row | MacRumors
Notepad++ Mac Port Renamed Nextpad++ After Trademark Row
Following last month's coverage of an unofficial Mac port of Notepad++ that the original developer called out for trademark violation, the dispute has now been resolved with a rebrand. The macOS port was previously released by Andrey Letov under the Notepad++ name without authorization. Don Ho created the original Windows code editor in 2003, and had publicly objected to the unofficial app's use of his trademark and the inclusion of his name and biography on its author page. After settling the dispute, the app has subsequently been renamed Nextpad++. The site for Nextpad++ has been thoroughly updated and clearly states that the app is an "open-source and independent community port of Notepad++ to macOS." Elsewhere, Letov's About page describes the project as a Mac port of the Notepad++ GPL codebase, built on Objective-C++, Scintilla, and Cocoa, and shipped as a universal binary for Apple silicon and Intel Macs. The app also has a new icon. Names aside, it seems Daring Fireball's John Gruber is less than charmed by the result, describing the app as feeling "unholy" and suggesting the rapid port could only have been built with AI vibe-coding tools. The site states development began on March 10. Have you tried out Nextpad++ for Mac? Let us know what you think in the comments.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:17 pm
Anker's New Prime Charging Station Returns to Low Price on Amazon | MacRumors
Anker's New Prime Charging Station Returns to Low Price on Amazon
Anker's new Prime 3-in-1 Wireless Charging Station has been marked down to $104.99 on Amazon, down from $149.99. This is one of Anker's newest accessories, and Amazon's sale today is a match of the all-time low price. This deal, and many of the others shared below, is being matched at Anker.com, with additional savings applied for members. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. The Prime 3-in-1 Wireless Charging Station features Qi2.2 support, which lets a compatible MagSafe ‌iPhone‌ charge at up to 25W. It's the same speed as Apple's ‌MagSafe‌ charger, and it is 10W faster than the standard Qi2 ‌MagSafe‌ chargers. You can also simultaneously charge an Apple Watch and AirPods with the device. $45 OFFAnker Prime 3-in-1 Wireless Charging Station for $104.99 There are plenty of other Anker discounts happening on Amazon this week, including Anker's popular 3-in-1 MagSafe-Compatible Charging Cube for $86.99, down from $129.99. Below you'll find a list of the best Anker discounts on Amazon this week, also including wall chargers, portable chargers, and more. Although it's not on sale, Anker recently launched a new desktop charging accessory with the Anker Nano Desk Clamp Power Strip for $69.99. The new device attaches to your desk and has 10 total ports including six AC outlets, two USB-C ports, and two USB-A ports. It supports 70W USB-C fast charging and comes in white and black color options. Wall Chargers Nano USB-C Wall Charger - $29.99, down from $39.99 140W 4-Port GaN USB-C Charger - $79.99, down from $99.99 Wireless Chargers 3-in-1 MagSafe-Compatible UFO Charger - $69.99, down from $89.99 3-in-1 MagSafe-Compatible Foldable Charging Station - $85.99, down from $109.99 3-in-1 MagSafe-Compatible Charging Cube - $86.99, down from $129.99 3-in-1 Prime Wireless Charging Station - $104.99, down from $149.99 Prime MagSafe-Compatible 3-in-1 Charging Station - $159.99, down from $229.99 Portable Chargers SOLIX C300 Power Station with Lantern - $179.99, down from $249.00 Prime Power Bank 26,250 mAh - $171.48, down from $229.99 SOLIX C1000 Gen 2 Portable Power Station - $449.99, down from $799.00 SOLIX C2000 Gen 2 Portable Power Station - $799.99, down from $1,499.00 If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:11 pm
You Might Want to Wait to Buy a New iPhone | MacRumors
You Might Want to Wait to Buy a New iPhone
While something new is always around the corner, now might be a particularly good time to hold off on buying a new iPhone if you are able to. The reason to consider waiting is that Apple is reportedly working on a special 20th-anniversary iPhone for release in September 2027, and rumors suggest that the device will feature the biggest redesign since the iPhone X in 2017. According to Bloomberg, the 20th-anniversary iPhone will have "glass edges that curve seamlessly into the display on all four sides." The Information reported that one of Apple's early 20th-anniversary iPhone prototypes lacked bezels around the screen. The device had only a "narrow metal band running around the midpoint of the device's edge, where the buttons sit." Apple has also aimed for the device to have no cutouts in the screen, according to The Information, but it is unclear if the company will be able to move both the front camera and the Face ID system under the screen by next year. Overall, it sounds like Apple has ambitious goals with the 20th-anniversary iPhone, and that makes it a device that might be especially worth waiting for. Of course, this advice will not apply to you if you upgrade your iPhone every single year regardless, but the average customer holds on to their iPhone for two to four years. In the meantime, Apple is expected to release the iPhone 18 Pro, iPhone 18 Pro Max, and its first-ever foldable iPhone in September 2026, followed by an iPhone 18, iPhone 18e, and a second-generation iPhone Air around March 2027.Tag: 20th-Anniversary iPhoneThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:04 pm
Few Smartphone Owners Care About Foldables or AI, Survey Suggests | MacRumors
Few Smartphone Owners Care About Foldables or AI, Survey Suggests
A new survey suggests most U.S. smartphone owners are not motivated to upgrade by foldable phone designs or AI features, a potential challenge for Apple as it prepares to launch both the rumored "iPhone Ultra" and an expanded suite of Apple Intelligence features this fall. The survey, commissioned by CNET and conducted by YouGov across 2,407 U.S. smartphone owners between April 29 and May 1, found that only 13% of respondents would consider upgrading for a phone concept such as a foldable or flip phone, while just 12% cited AI integrations as an upgrade motivator. Among iPhone owners specifically, interest in foldable designs was slightly higher at 14%. Apple is widely expected to launch its first foldable iPhone alongside the iPhone 18 Pro this fall, with a starting price of around $2,000. While a 13% interest statistic in foldable designs has been characterized as evidence of limited appeal, it may actually represent a larger addressable market than anticipated for a product most consumers have never used and whose likely price was not disclosed to respondents. Interest could shrink considerably once a $2,000-plus price tag enters the picture, and supply chain reports suggest smooth availability may not occur until 2027. Consumer sentiment around AI integrations dropped sharply from 2024 to 2025 before edging slightly higher in 2026, though the figure remains low at 12%. Previous surveys found that the majority of iPhone users felt existing ‌Apple Intelligence‌ features added little to no value to their experience. Price remains the overwhelming driver of upgrade decisions, cited by 55% of respondents, followed by longer battery life at 52%, and more storage at 38%. Those top three motivators are unchanged from 2025, when price led at 62%, battery life at 54%, and storage at 39%. Camera features (27%) and display size (22%) ranked well ahead of either foldables or AI as upgrade motivators. Smartphone owners are also not particularly swayed by a phone being thinner or available in new colors, findings that are relevant given Apple's recent emphasis on the ultra-thin iPhone Air and expanded color options across its lineup.Related Roundup: iPhone FoldTags: Apple Intelligence, CNETThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
10:25 am
Apple Project Files Allegedly Stolen in Foxconn Ransomware Attack | MacRumors
Apple Project Files Allegedly Stolen in Foxconn Ransomware Attack
Apple supplier Foxconn has confirmed a cyberattack on several of its U.S. factories, after a ransomware group claimed to have stolen confidential Apple project files as part of the hack. The Nitrogen group posted the breach on its data leak site this week, claiming to have made off with 8TB of data spanning more than 11 million files. Alongside the allegedly stolen Apple files, Nitrogen claims the trove includes internal project documentation and technical drawings tied to Intel, Google, Dell, and Nvidia. Foxconn confirmed the intrusion to The Register on Tuesday, but the supplier did not respond to questions regarding whether any customer data was actually taken. A company spokesperson said its cybersecurity team activated response measures to keep production running, and that all of its affected factories are resuming normal operations. Foxconn assembles a wide range of Apple products, but Apple famously takes the secrecy of unreleased products extremely seriously, and suppliers typically receive only the technical information needed for their specific role in manufacturing. Nitrogen is believed to be an offshoot of leaked Russia-based Conti 2 ransomware code. If so, though, the stolen files may be inaccessible. Researchers at Coveware warned in February that a bug in the group's ESXi encryptor makes file recovery impossible, even for victims who pay up. It's not the first time Foxconn has been targeted by ransomware gangs. The manufacturer was previously hit by LockBit in 2022 and 2024.Tag: FoxconnThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
12:00 am
Google Unveils Googlebook, a New AI Laptop Built Around Gemini | MacRumors
Google Unveils Googlebook, a New AI Laptop Built Around Gemini
Google today announced a new series of Googlebook laptops that will be built with Gemini at the core. Googlebooks will run software built on a foundation that combines Android and ChromeOS. Google says the new laptops are designed for Gemini Intelligence for a more personalized and proactive experience. Instead of a cursor, Googlebooks have a Magic Pointer that users can wiggle to activate Gemini. Gemini can then provide contextual suggestions and answers based on whatever the user is pointing to on the screen. Pointing at a date in an email sets up a meeting, and selecting two images allows them to be visualized together. There are ask, compare, and combine tools available with the Magic Pointer. Create My Widget, a new Android feature, is coming to Googlebooks. Users can create custom widgets with a Gemini prompt. Gemini is able to search the internet and connect with Google apps like Gmail and Calendar to create a personalized dashboard that can be used for widget creation. Since Googlebooks will run Android, it will be easier to switch between a Googlebook and an Android smartphone. Apps from a connected Android smartphone will be available on the Googlebook, with a feature set similar to Apple's iPhone Mirroring. Quick Access will let users view, search, or insert files from a smartphone on the laptop, with no transfer needed. Google says it is working with Acer, ASUS, Dell, HP, and Lenovo to make the first Googlebooks. The machines will be built with "premium craftsmanship and materials, coming in a variety of shapes and sizes." Each one will have a "glowbar" on the lid, making it clear that it's a Googlebook. Google has not given insight into Googlebook pricing, but with the specific "premium" build language, they could be priced above the low-cost MacBook Neo that Apple recently came out with. It's also possible that Googlebooks will have MacBook Neo-level pricing to better compete with Apple's laptop in on pricing and build quality. The first Googlebooks are set to launch this fall.Tags: Android, GoogleThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
Tuesday May 12
11:24 pm
Bartender Pro Brings Widgets, Clipboard, and File Storage to the MacBook Notch | MacRumors
Bartender Pro Brings Widgets, Clipboard, and File Storage to the MacBook Notch
Popular Mac menu bar management app Bartender received an upgrade today with the launch of Bartender Pro. Bartender Pro adds a new Top Shelf feature to the Mac's notch, with access to multiple utility tools. Top Shelf can be used for clipboard access, storing files, controlling audio, and sending content over AirDrop. It supports widgets for calendar, weather, and music apps like Apple Music or Spotify. There's a full Now Playing music controller, and options to get alerts when scheduled events are coming up. Top Shelf expands the size of the notch, turning it into something like the iPhone's Dynamic Island. Users can drag files over to the notch to store them or send them via AirDrop, and access a clipboard. The clipboard can be set to automatically capture content that's copied, with options to ignore passwords. There are customizable duration options for both the clipboard and file storage. Widgets in Top Shelf are customizable, and it supports a Live Activity-like tracking feature for AI agents like Codex and Claude Code. Info like volume, display brightness, and battery level is also available. Top Shelf works alongside Bartender, and all of the standard Bartender features are available with Bartender Pro. When not in use, Top Shelf is tucked away much like Bartender, and it disappears when Bartender is expanded. While it is a tool designed around the notch, it also works on Macs that don't have one. Bartender Pro is optional, and users who don't need the extra features can stick with Bartender 6. Bartender Pro is priced at $15 per year. The subscription includes Bartender 6, all future upgrades for the subscription duration, and the Bartender Pro suite. Bartender 6 is still available for a one-time $20 purchase, and the $80 Mega Supporter option continues to offer lifetime Bartender access with Bartender Pro included. Bartender Pro and Bartender 6 are available from the Bartender website.Tag: WidgetsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
09:48 pm
Google Makes It Easier to Share Files Between Android and iPhone | MacRumors
Google Makes It Easier to Share Files Between Android and iPhone
Google today said it is introducing updated file sharing features that will make it easier for Android users to send files to iPhone users. Quick Share is already compatible with Apple's AirDrop feature on select Android devices, but Google says the feature will expand to Samsung, OPPO, OnePlus, Vivo, Xiaomi, and HONOR devices in 2026. On Android devices that are not compatible with AirDrop, Quick Share can be used to generate a QR code that can instantly share content with iOS devices via the cloud. The QR code sharing feature is rolling out to all Android devices starting today, and will be fully available within the next month. Google says it also plans to make Quick Share available in apps like WhatsApp in the near future. Google says that it also worked with Apple to make it easier to switch from an iPhone to an Android device, capabilities the two companies had to implement under Europe's Digital Markets Act. While Apple implemented the feature in iOS 26.3, Google says it will be coming to Samsung Galaxy and Google Pixel devices in 2026. The transfer process will allow eSIM, passwords, photos, messages, apps, contacts, and Home Screen layout to migrate wirelessly from an iPhone to an Android device. Google has also implemented similar tools for simplifying switching between an Android device and an iPhone.Tags: Android, GoogleThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
08:38 pm
iOS 27 Getting Major Siri Redesign With Chat Interface and Dedicated App | MacRumors
iOS 27 Getting Major Siri Redesign With Chat Interface and Dedicated App
Apple is introducing an overhauled version of Siri in iOS 27, evolving the personal assistant into a more capable chatbot and AI agent able to compete with ChatGPT, Claude, and Gemini. With ‌Siri‌'s transition, Apple will be making multiple Siri-related design changes in ‌iOS 27‌, according to a new report from Bloomberg. ‌Siri‌ will largely live in the Dynamic Island in ‌iOS 27‌, but there will also be a dedicated ‌Siri‌ app for the first time. When ‌Siri‌ is activated with the ‌Siri‌ wake word or through the iPhone's side button, a pill-shaped animation will be displayed in the ‌Dynamic Island‌. When ‌Siri‌ is asked a question or given a task, there will be a transparent results card. Swiping on it will bring up a conversation mode that looks similar to an iMessage chat, and it will incorporate small cards for the weather, notes, upcoming appointments, and other information that's relevant to queries. Apple is also designing a full ‌Siri‌ app for ‌Siri‌ conversations. It will allow users to look back at prior chats, and begin new ‌Siri‌ chats. There is a grid of rectangles with summaries of past conversations that users can tap into, a search bar, and a "+" button for starting a new conversation. The app will support uploading images and documents, and users will be able to type to ‌Siri‌ or use voice input. Swiping down from the top center of the display in any app will activate a system-wide search interface, with a "Search or Ask" bar in the ‌Dynamic Island‌ for typing or speaking questions. Search or Ask is similar to Spotlight Search, but Bloomberg suggests it will display "more advanced results and additional data from within apps." ‌Siri‌ will be able to draw information from the web to provide detailed answers to the typical questions users ask chatbots. ‌Siri‌'s responses will include bullet points with information and large images. While ‌Siri‌ is the default for the search bar, pressing on it will let users select other chatbots to speak with, such as ChatGPT or Gemini. Apple plans to let users choose third-party AI services as the default for Apple Intelligence features like Writing Tools and Image Playground, expanding ‌Apple Intelligence‌ integration beyond ChatGPT. Apple plans to overhaul the ‌Image Playground‌ app. The interface for generating a new image has fewer controls and a "describe a change" option for editing images that are created. Previously created images are displayed in a grid with more rounded edges, and instead of a New Image button, there's a "+" button. Apple has also been testing new models that produce more lifelike images, so we could see new image generation capabilities in ‌iOS 27‌. Apple is also planning changes to the Camera app, Photos app, Wallet, and Shortcuts, plus there could be tweaks to Liquid Glass. More on what to expect from ‌iOS 27‌ can be found in our iOS 27 roundup.Related Roundup: iOS 27Tags: Bloomberg, Mark Gurman, SiriThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
08:12 pm
iOS 27 to Bring Customizable Camera App, Tweaks to Weather, Safari and Liquid Glass | MacRumors
iOS 27 to Bring Customizable Camera App, Tweaks to Weather, Safari and Liquid Glass
Apple plans to make the Camera app more customizable in iOS 27, reports Bloomberg. Users will be able to select the features they want to see in the Camera app, like flash, exposure, timer, depth of field, photo styles, and resolution. Camera controls, labeled as widgets, will be able to be placed at the top of the Camera interface in any order. Users will be able to select widgets from a transparent widget tray that comes up from the bottom of the app. Widgets will be organized into categories that include basic, manual, and settings. Apple plans to use the same default layout that's available now with quick tap buttons for flash, Live Photos, and Night Mode, but the customizable interface will be added as a new advanced layout that will appeal to professional users. Different modes like photo and video will have their own set of widgets, as will a new Siri camera mode that Apple plans to add to the app. ‌Siri‌ mode will incorporate the Visual Intelligence features that are currently accessible through the Camera Control or Action buttons. Right now, users can tap into a view with all of the Camera controls from the top right of the app, but that view is moving to the right of the shutter button. Apple will also add new grid and level options. In the Weather app, there will be a new Conditions panel for switching between temperature, rain, and wind. It will be the same as the interface that's available when tapping into one of the weather modules in the current version of the app. Apple plans to add an updated start page to Safari, and it will have four tabs across the top for swapping between favorites, bookmarks, Reading List, and history. There are system-wide design changes coming as well, according to Bloomberg. The tab bar in apps like Apple Music, Podcasts, News, and Apple TV will be adjusted to combine search with the other navigation options. Apple separated search in many apps when introducing Liquid Glass, but it sounds like the company is going to revert to the prior unified design. When using the on-screen keyboard, there's a new animation that shows the keys sliding up from the bottom of the iPhone interface, plus Apple is adding redo and undo controls for fixing actions when customizing the Home Screen's icon and widget layouts. Apple is planning to preview ‌iOS 27‌ at the Worldwide Developers Conference that begins on June 8.Related Roundup: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
07:21 pm
Google Previews Android 17 With 'Gemini Intelligence' a Month Before Apple's iOS 27 Reveal | MacRumors
Google Previews Android 17 With 'Gemini Intelligence' a Month Before Apple's iOS 27 Reveal
Google today previewed Android 17, the next version of Android that it is bringing to smartphones and other devices. Android 17 includes multiple new AI features, and it comes about a month ahead of when Apple plans to unveil iOS 27 with new AI capabilities. Google is now calling the AI features on Android "Gemini Intelligence," branding similar to Apple Intelligence. Google said it is transitioning Android from an operating system to an intelligence system, with proactive, on-device agentic AI. Expanded Gemini integration - Gemini will be able to do more tasks autonomously, from booking classes to making purchases. Visual context - Gemini will be able to draw context from what's on the screen, which is something that Apple is also bringing to iPhones soon. Google says Android users will be able to do things like bring up a long shopping list in the notes app, long press on the power button over the list, and have Gemini build a shopping cart with all of the items for delivery. Smarter web browsing - Gemini in Chrome will let users research, summarize, and compare content on the web. Chrome auto browse will also be able to do more tasks like reserving a parking spot or booking an appointment. Autofill - Android can fill more text fields in apps with Gemini's Personal Intelligence that draws information from apps like Gmail and Google Photos. Rambler - Rambler is an AI voice dictation feature that cuts out filler words like um, ah, and like. Rambler will take the important parts from voice dictation, and create a concise message. It works with multiple languages at once. Create My Widget - Create My Widget lets Android users build custom widgets by describing what they want in natural language. Widgets can do things like provide the weather, offer recipes, count down to events, provide the time, display stock info, and more. There are other changes coming to Android 17 too. 3D Emoji - Google is adopting Noto 3D, a new 3D emoji collection. Android Auto - Android Auto is getting expanded Gemini integration and a refreshed look with support for the Material 3 Expressive design. Google is adding customizable widgets, edge-to-edge Google Maps, and Immersive Navigation, which includes 3D views highlighting important navigation details. When parked, cars will support YouTube playback. Gemini Intelligence is coming to Android Auto cars, and it will be able to do things like respond to texts automatically or order food for pickup. Google built-in - Cars with Google built-in are getting the same features, plus access to meeting apps like Zoom. Gemini is also rolling out to cars with Google built-in, and it can answer questions specific to each vehicle that it's installed in. Screen Reactions - Screen Reactions lets users film with the front and back cameras at the same time for social media reaction videos. Instagram integration - Google worked with Meta to improve the video and photo quality of content captured with Android devices and uploaded to Instagram. Google is also adding new tools to the Edits app, and improving Instagram on Android tablets. Pause Point - Users can set an app as distracting, and Pause Point will give a 10-second breather before an app opens. Users can do a short breathing exercise or set a timer to limit time in the app. There are also options for looking at favorite photos, or moving to an alternative app like an audiobook app. Pause Point requires users to restart a phone to turn it off, which makes it more difficult to ignore. Google says Gemini Intelligence features will roll out in waves beginning with the latest Samsung Galaxy and Google Pixel phones this summer, and expanding to Android watch, car, glasses, and laptops later in the year. Gemini in Chrome features will be available in late June, with other Android 17 features expected to get to a stable release stage in June.Related Roundup: iOS 27Tags: Android, GoogleThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:53 pm
Apple Watch Hypertension Alerts and AirPods Hearing Aid Feature Expand to More Countries | MacRumors
Apple Watch Hypertension Alerts and AirPods Hearing Aid Feature Expand to More Countries
Apple today said Hearing Aid features are now available for the AirPods Pro 2 and AirPods Pro 3 in Italy, Romania, and Czechia, while Hypertension alerts have expanded to Israel. The Hearing Aid option allows the AirPods Pro to be used as an over-the-counter alternative to a traditional set of hearing aids. The AirPods Pro can improve sound to mitigate mild to moderate hearing loss, adjusting voices and sounds around the user to improve hearing. It can also set music, videos, and phone calls to optimal sound levels using a personalized hearing profile created after taking a Hearing Test. Loud Sound Reduction also prevents hearing damage from loud ambient noise by cutting down on high-decibel sound when using Transparency and Adaptive modes. Hearing Aid capabilities are available with the AirPods Pro 2 and ‌AirPods Pro 3‌ when paired with a device running iOS 26/iPadOS 26 or later. In Israel, users will be able to get an alert if the Apple Watch detects signs of chronic high blood pressure. Alerts use data collected from the heart rate sensor over a 30-day period. Hypertension alerts are available on the Apple Watch Series 9 and later and the Apple Watch Ultra 2 and later.Related Roundups: AirPods 4, Apple Watch 11Buyer's Guide: AirPods (Neutral), Apple Watch (Caution)Related Forum: AirPodsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:16 pm
M5 MacBook Pro Hits Record Low Price With Major $300 Discount at Amazon | MacRumors
M5 MacBook Pro Hits Record Low Price With Major $300 Discount at Amazon
Apple's newest M5 Pro and M5 Max MacBook Pro models have been hitting new low prices on Amazon recently, and now the M5 model from 2025 has a new record low price. You can get the 32GB/1TB 14-inch M5 MacBook Pro for $1,799.00, down from $2,099.00. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. At $300 off, this is now the lowest price we've ever tracked on this model, and it's only available in Silver. This is the model that launched in the fall of 2025 as part of a refresh of the MacBook Pro lineup, featuring a 14.2-inch Liquid Retina XDR display and 10-core CPU and 10-core GPU. $300 OFFM5 MacBook Pro (32GB/1TB) for $1,799.00 Amazon provides an estimated delivery date of May 13-14 for free delivery options, depending on your location. If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:59 pm
Stop Chrome Browser From Downloading a Hidden 4GB AI File | MacRumors
Stop Chrome Browser From Downloading a Hidden 4GB AI File
If your Mac's storage has been mysteriously shrinking recently and you use Google Chrome, you may have already identified the culprit. The browser has been downloading a 4GB AI model file onto computers without explicit user consent. Here's how to reclaim the space. The file in question is called "weights.bin," which powers Google's on-device Gemini Nano AI model – the engine behind Chrome features like scam detection, autofill suggestions, and the "Help Me Write" tool. Local models tend to be pretty big storage-wise, and this one is no different. The problem is that Google hasn't clearly signposted the fact that it's eating 4GB of your drive with training data. The issue only recently came to light thanks to security researcher Alexander Hanff, who noticed that Chrome installs the model on any device meeting the minimum hardware requirements, only without prompting you whether you'd like it there in the first place. How to Check if the File Is on Your Mac The first thing to do is confirm that the model is actually taking up space on your machine. While there's no clear answer in Google's release notes, recent reports suggest that the file started appearing after updating to Chrome version 148.0.7778.97. Here's how you can find out if your computer was affected: Open Finder, then click Go in the menu bar. Hold the Option key and click Library in the dropdown menu. Open Application Support ➝ Google ➝ Chrome ➝ Default. Look for a folder named "OptGuideOnDeviceModel." If the folder exists and contains a file called weights.bin, the model is installed. You can right-click the file and choose Get Info to confirm its size. If the folder isn't there, you can relax – Chrome hasn't downloaded the model to your Mac. How to Remove the 4GB File for Good Simply deleting weights.bin from Chrome's library folder isn't a long-term solution because Chrome will likely quietly re-download it the next time you launch the browser. To make the removal permanent, you need to disable Chrome's on-device AI features. Open Chrome. Click the three-dot menu in the top-right corner, then choose Settings. In the left sidebar, click System. Toggle off On-device AI. Once this setting is switched off, Chrome will remove the model and should stop downloading it in future updates. Remember that deleting the model will also disable any Chrome features that rely on it. If you don't see the toggle in Chrome's Settings, it likely hasn't propagated to your computer yet. In that case, type chrome://flags into Chrome's address bar and disable any AI-related flags you see, then delete the weights.bin file manually in Finder. If after that you're still concerned about the lack of consent, it might be worth switching to a different browser.Tag: ChromeThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:50 pm
Bluey is Taking Over Apple Arcade Next Week | MacRumors
Bluey is Taking Over Apple Arcade Next Week
Apple today announced that characters from the hit animated kids show Bluey are coming to five Apple Arcade games starting Thursday, May 21, as part of a limited-time crossover event. The games that will be receiving Bluey updates include Crossy Road Castle, stitch., puffies., Suika Game+, and Disney Coloring World+. Bluey is coming to Crossy Road Castle Apple Arcade will also be adding another four games on Thursday, June 4: Mini Football Legends, My Talking Tom 2+, Coffee Inc 2+, and FreeCell Solitaire: Card Game+. More details about each game are outlined in Apple's announcement. Apple Arcade is a subscription service that provides access to hundreds of games across the iPhone, iPad, Mac, Apple TV, and Apple Vision Pro. All of the games are free of ads and in-app purchases. In the U.S., Apple Arcade costs $6.99 per month, and it is also bundled with other Apple services in all Apple One plans. Apple Arcade can be accessed through the App Store and the Apple Games app.Tags: Apple Arcade, BlueyThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:43 pm
Apple Sales Coach Will Use AI-Generated Video Presenters | MacRumors
Apple Sales Coach Will Use AI-Generated Video Presenters
The Apple Sales Coach app will begin using AI-generated video presenters to deliver personalized training content to retail salespeople around the world. In a new video message, an Apple trainer said that the update addresses a limitation of traditional training programs: the impossibility of creating truly individualized content for hundreds of thousands of salespeople across different markets, languages, and product focuses. Apple said it will now use AI to generate short, focused videos tailored to the products a seller works with, the skills they are developing, and the language they speak. Apple to Use AI-Generated Presenters for Sales Training Videos pic.twitter.com/6DRkLAvyfm— Aaron (@aaronp613) May 12, 2026 AI-generated presenters will be identifiable by an on-screen icon, and Apple emphasized that the underlying content remains entirely human-driven. The company's training team apparently writes every script and verifies every detail, with AI serving as the delivery mechanism rather than the author. Apple said the shift will allow it to produce more videos on more topics, faster, and update them more frequently than was previously possible. The company described the move as "just the beginning," noting that Apple Sales Coach improves the more it is used.Tag: Artificial IntelligenceThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:14 pm
Much Brighter iPhone Display Still Years Away, Leaker Suggests | MacRumors
Much Brighter iPhone Display Still Years Away, Leaker Suggests
Chinese leaker "Instant Digital" today said the iPhone 18 Pro will not feature dual-layer OLED technology, adding that Apple's current thermal management approach remains a limiting factor for sustained outdoor brightness on Pro iPhones. In a new post on Weibo, Instant Digital commented on a question about when dual-layer OLED would arrive on iPhone, saying simply: "In any case, the 18 Pro definitely won't have it." The leaker had earlier this week reflected on last year's predictions, noting that the iPhone 17 Pro made little meaningful progress in maintaining peak brightness levels outdoors. Instant Digital suggested that without a change to Apple's thermal throttling strategy, dual-layer OLED is the only path to a significant real-world brightness improvement. The assessment aligns with what has been rumored elsewhere. A report from last August indicated that Apple has set a two-year production plan for tandem OLED to be adapted for the iPhone, but that Apple had yet to decide whether to develop the panels with Samsung Display or LG Display, pointing to an arrival no earlier than sometime after 2028. The report also noted that the variant Apple is reviewing differs from the full tandem OLED used in the iPad Pro. Rather than stacking two complete RGB layers, Apple is said to be evaluating a "simplified tandem" design that doubles only the blue sub-pixel layer while keeping red and green on a single layer. For the ‌iPhone 18 Pro‌, the display upgrade on the table is said to be a move to LTPO+ technology. As reported earlier this month, Apple is expected to finalize panel approvals for the ‌iPhone 18 Pro‌ and Pro Max with Samsung Display and LG Display, with China's BOE reportedly closed out of the premium tier due to quality and yield issues with its own LTPO+ technology. The upgrade from the standard LTPO used in the ‌iPhone 17 Pro‌ should improve battery efficiency by enabling finer control of OLED light emission, but it does not address peak brightness or the thermal throttling that limits sustained outdoor luminance. Dual-layer OLED would address both matters. Since each emissive layer operates at lower intensity to achieve a given brightness target, the display generates less heat, reducing the thermal pressure that causes Apple's current panels to throttle under sustained use. The M4 ‌iPad Pro‌ was the first Apple product to adopt the technology. Instant Digital's comments suggest iPhone customers will have to wait considerably longer.Tag: Instant DigitalThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »

Older posts

Tuesday May 05
10:00 am
Microsoft 365 Copilot, human agency, and the opportunity for every organization | Office for Mac
Microsoft 365 Copilot, human agency, and the opportunity for every organization
As AI and agents take on more of the execution, people have more agency than ever to unlock their ambition, direct what gets done, and own the outcomes. The post appeared first on Microsoft 365 Blog.
Read more »
10:00 am
Copilot Cowork: From conversation to action across skills, integrations, and devices | Office for Mac
Copilot Cowork: From conversation to action across skills, integrations, and devices
Today, we’re announcing additional capabilities in Cowork to expand on what it can make possible for you. The post appeared first on Microsoft 365 Blog.
Read more »
Friday May 01
03:00 pm
Microsoft Agent 365, now generally available, expands capabilities and integrations | Office for Mac
Microsoft Agent 365, now generally available, expands capabilities and integrations
Microsoft Agent 365 helps you take control of agent sprawl as your control plane to observe, govern, and secure agents and their interactions. The post appeared first on Microsoft 365 Blog.
Read more »
Thursday April 23
12:00 am
Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available | Office for Mac
Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available
From first draft to final polish, Copilot acts as a true collaborator, taking action while you stay in control. The post appeared first on Microsoft 365 Blog.
Read more »
Monday April 13
03:00 pm
Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot | Office for Mac
Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot
Microsoft 365 Copilot can now bring your go-to apps directly into the conversation, which closes the gap between AI-powered insight and real, in-app action. The post appeared first on Microsoft 365 Blog.
Read more »
Wednesday April 01
09:45 pm
New and improved: Multi-agent orchestration, connected experiences, and faster prompt iteration | Office for Mac
New and improved: Multi-agent orchestration, connected experiences, and faster prompt iteration
Learn what’s new in Copilot Studio: Multi-agent systems are now generally available, plus recent updates to the Prompt Editor and governance controls. The post appeared first on Microsoft 365 Blog.
Read more »
Monday March 30
01:00 pm
Copilot Cowork: Now available in Frontier | Office for Mac
Copilot Cowork: Now available in Frontier
Today, Copilot Cowork—designed for long-running, multi-step work in Microsoft 365—is available via the Frontier program. The post appeared first on Microsoft 365 Blog.
Read more »
Wednesday March 25
01:00 pm
New In-App Purchase and subscription data now available in Analytics | ADC Headlines
New In-App Purchase and subscription data now available in Analytics
Analytics in App Store Connect receives its biggest update since its launch, including a refreshed user experience that makes it easier to measure the performance of your apps and games. Updates include: More than 100 new metrics. Now you can access monetization and subscription data in Analytics to better understand the performance of your In-App Purchases and offers. New cohort capabilities. Analyze user behavior based on common attributes — such as download date, download source, offer start date, and more — to measure how a particular group of users performs over time. For example, if you’ve expanded your app to a new region, you can monitor how long it takes users in that region to make a purchase compared to other more established regions. Cohort data is aggregated to ensure user privacy. New peer group benchmarks. Discover how you stack up to peers with two new monetization benchmarks: download-to-paid conversion and proceeds per download. Benchmarks incorporate differential privacy techniques to protect individual developer performance while also providing meaningful and actionable insights. Two new subscription reports. Export these via the Analytics Reports API to perform offline analysis and integrate Analytics into your own data systems. Additional filters. Apply up to seven filters to your selected metrics at once allowing you to drill down further and uncover additional insights. App Store Analytics Guide. This new guide in App Store Connect Help enables you to develop a data-driven strategy and understand App Store tools and features you can use to grow your business. Learn about measuring performance with AnalyticsRead the new Analytics guide
Read more »

Reviews & KoolTools

Unbreakable Style: The Best Hardshell Phone Cases on the Market

Are you looking for the ultimate protection for your smartphone? Hardshell phone cases are the answer. These cases are designed to withstand impact. They keep your phone safe from drops and scratches. In a world full of choices, how do you find the best? We have...

Plugable’s 5-in-1 USB Hub expands your MacBook Pro or MacBook Air’s connection options

The new 5-in-1 USB-C hub from Plugable turns two Mac laptop ports into (as the name implies) five, including Ethernet and more. Designed specifically for MacBook Pro and MacBook Air models, the hub (with the moniker AMS-5IN1E) fits flush against the host Mac and adds...

More Reviews & KoolTools

Community and More

MacTech Events and COVID

Due to the pandemic, the regional MacTech Pro events were pushed into 2021 — as early as reasonably possible. This means at best, early in the third quarter of the year. But depending on guidance and public health, it could be later than that. Once there are details,...

More Community

Software & Services Scanners

Tuesday May 12
09:46 pm
Patch Tuesday, May 2026 Edition | Krebs on Security
Patch Tuesday, May 2026 Edition
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers -- including Apple, Google, Microsoft, Mozilla and Oracle -- fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.
Read more »
Friday May 08
02:58 am
Canvas Breach Disrupts Schools & Colleges Nationwide | Krebs on Security
Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.
Read more »
Tuesday May 05
04:16 pm
Vulnerability Summary for the Week of April 27, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of April 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info n/a-- OVMS3 3.3.005 Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. 2026-05-01 10 CVE-2026-37541 https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 tendacn[.]com-- W308R Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25316 ExploitDB-44373VulnCheck Advisory: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change tendacn[.]com--W3002R Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers. 2026-04-29 9.8 CVE-2018-25317 ExploitDB-44380VulnCheck Advisory: Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change tendacn[.]com--FH303/A300 Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25318 ExploitDB-44381VulnCheck Advisory: Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change Weaver Network Co., Ltd.--E-office Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC). 2026-04-30 9.8 CVE-2022-50993 https://service.e-office.cn/knowledge/detail/5https://cn-sec.com/archives/1453025.htmlhttps://bbs.chaitin.cn/topic/37https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet synway[.]net-- SMG Gateway Management Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC). 2026-04-30 9.8 CVE-2025-71284 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yamlhttps://mrxn.net/jswz/synway-9-2radius-rce.htmlhttps://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsAhttps://www.synway.net/https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address Directorist Booking--Directorist Booking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2. 2026-04-27 9.3 CVE-2026-22336 https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve Directorist--Directorist Social Login Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4. 2026-04-27 9.8 CVE-2026-22337 https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. 2026-04-27 9.8 CVE-2026-32644 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware n/a--Automotive Grade Linux (AGL) AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently. 2026-05-01 9.8 CVE-2026-37531 https://gerrit.automotivelinux.org/gerrit/src/app-framework-mainhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a-- cannelloni v2.0.0 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. 2026-05-01 9.8 CVE-2026-37539 https://github.com/mguentner/cannellonihttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 Carlson Software--VASCO-B GNSS Receiver The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials. 2026-04-28 9.4 CVE-2026-3893 https://www.carlsonsw.com/support-and-training/https://www.cve.org/CVERecord?id=CVE-2026-3893https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json Mersenne--Prime95 Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands. 2026-04-29 8.4 CVE-2018-25299 ExploitDB-44649Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH xataboost--XATABoost CMS XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information. 2026-04-29 8.2 CVE-2018-25300 ExploitDB-44622Official Product HomepageVulnCheck Advisory: XATABoost CMS 1.0.0 SQL Injection via news.php Easy MPEG--Easy MPEG to DVD Burner Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe. 2026-04-29 8.4 CVE-2018-25301 ExploitDB-44565Product ReferenceVulnCheck Advisory: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow Alloksoft--Allok Video to DVD Burner Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution. 2026-04-29 8.4 CVE-2018-25303 ExploitDB-44518Official Product HomepageVulnCheck Advisory: Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH Filehippo--Free Download Manager Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code. 2026-04-29 8.4 CVE-2018-25304 ExploitDB-44499Product ReferenceVulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH Sysgauge--SysGauge Pro SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges. 2026-04-29 8.4 CVE-2018-25307 ExploitDB-44455VulnCheck Advisory: SysGauge Pro 4.6.12 Local Buffer Overflow SEH donmik--Buddypress Xprofile Custom Fields Type BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. 2026-04-29 8.8 CVE-2018-25308 ExploitDB-44432Official Product HomepageVulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution Alloksoft--WMV to AVI MPEG DVD WMV Converter Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious input containing shellcode with structured exception handler (SEH) overwrite to bypass protections and execute code with application privileges. 2026-04-29 8.4 CVE-2018-25314 ExploitDB-44365Official Product HomepageProduct ReferenceVulnCheck Advisory: Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow Alloksoft--Video Joiner Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with structured exception handler (SEH) overwrite and shellcode to achieve code execution when the application processes the license registration input. 2026-04-29 8.4 CVE-2018-25315 ExploitDB-44364Official Product HomepageProduct ReferenceVulnCheck Advisory: Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name marketingfire--Widget Options Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0. 2026-05-02 8.8 CVE-2026-2052 https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cvehttps://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534https://plugins.trac.wordpress.org/changeset/3481338/https://plugins.trac.wordpress.org/changeset/3514411/ Milesight--MS-Cxx63-PD An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. 2026-04-27 8.8 CVE-2026-20766 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware wclovers--WCFM Frontend Manager for WooCommerce The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. 2026-05-02 8.1 CVE-2026-2554 https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cvehttps://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386https://plugins.trac.wordpress.org/changeset/3483695/ opencats--OpenCATS OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete. 2026-04-28 8.1 CVE-2026-27760 https://chocapikk.com/posts/2026/opencats-installer-rce/https://github.com/opencats/OpenCATS/pull/706https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. 2026-04-27 8.8 CVE-2026-27785 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware Cockpit--Cockpit CMS Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server. 2026-04-29 8.8 CVE-2026-34965 https://github.com/agentejo/cockpithttps://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections n/a--(UDS) & OBD-II (On Board Diagnostics for Vehicles) miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. 2026-05-01 8.8 CVE-2026-37536 https://github.com/miaofng/uds-chttps://github.com/openxc/uds-chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a--Open-SAE-J1939 (Daniel Martensson) collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt- >data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. 2026-05-01 8.1 CVE-2026-37537 https://github.com/DanielMartensson/Open-SAE-J1939https://github.com/collin80/Open-SAE-J1939https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 openampproject[.]org--OpenAMP v2025.10.0 OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. 2026-05-01 8.4 CVE-2026-37540 https://github.com/OpenAMP/open-amphttps://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a--MixPHP Framework 2.x Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to OpisClosureunserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution. 2026-05-01 8.4 CVE-2026-37552 https://github.com/mix-php/mixhttps://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phphttps://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 benjaminprojas--WP Editor The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. 2026-05-01 8.8 CVE-2026-3772 https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cvehttps://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103https://plugins.trac.wordpress.org/changeset/3480577/ chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0. 2026-04-30 8.1 CVE-2026-40600 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xmhttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 TRENDnet--TEW-821DAP A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer. 2026-05-02 8.8 CVE-2026-7607 VDB-360564 | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowVDB-360564 | CTI Indicators (IOB, IOC, IOA)Submit #806214 | Trendnet TEW-821DAP v1.12B01 CWE-120 Buffer Copy without Checking Size of Inputhttps://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_BO.md carazo--Import and export users and customers The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page. 2026-05-02 8.8 CVE-2026-7641 https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cvehttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21https://plugins.trac.wordpress.org/changeset/3515646 Cozmoslabs--Profile Builder Pro The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory. 2026-05-02 8.1 CVE-2026-7647 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L13https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L13 Shenzhen Libituo Technology--LBT-T300-HW1 A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 8.8 CVE-2026-7674 VDB-360827 | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowVDB-360827 | CTI Indicators (IOB, IOC, IOA)Submit #800705 | Libtor Technology lbt-t300-hw1 closure, xreq). The NULL propagation chain through afb-context.c:110 (context- >credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context- >credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14. 2026-05-01 7.8 CVE-2026-37525 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) afb-daemon v19.90.0 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29. 2026-05-01 7.8 CVE-2026-37526 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) aglservice v17.1.12 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer. 2026-05-01 7.1 CVE-2026-37532 https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-levelhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) isotp-c openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information. 2026-05-01 7.1 CVE-2026-37535 https://github.com/openxc/isotp-chttps://github.com/openxc/isotp-c/blob/master/src/isotp/receive.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a-- Vanetza V2X v26.02 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver. 2026-05-01 7.5 CVE-2026-37554 https://github.com/riebl/vanetzahttps://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpphttps://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpphttps://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40595 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4060 https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1767https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1785https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/ chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40601 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-cpr6-mhgm-893whttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb- >prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings. 2026-05-02 7.5 CVE-2026-4061 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1748https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Hooks/SearchResults.php#L39https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Search.php#L152https://plugins.trac.wordpress.org/changeset/3503627/ cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context - `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4062 https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/ n/a--libssh2 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. 2026-05-01 7.3 CVE-2026-7598 VDB-360555 | libssh2 userauth.c userauth_password integer overflowVDB-360555 | CTI Indicators (IOB, IOC, IOA)Submit #805564 | libssh2 Shell interface, gaining root-level access to the device. 2026-04-29 4.3 CVE-2018-25310 ExploitDB-44387Vulnerability AdvisoryVulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution gnu--wget2 wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. 2026-04-29 4.8 CVE-2026-1858 https://www.tenable.com/security/research/tra-2026-37 wazuh--wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4. 2026-04-29 4.4 CVE-2026-26204 https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857https://github.com/wazuh/wazuh/releases/tag/v4.14.4 Oracle Corporation--Oracle Linux An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context. 2026-05-01 4.4 CVE-2026-35233 Oracle Advisory n/a-- V2Board v1.7.4 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis. 2026-05-01 4.9 CVE-2026-37505 https://github.com/v2board/v2boardhttps://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 nextlevelbuilder--ui-ux-pro-max-skill A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet. 2026-05-01 4.3 CVE-2026-7596 VDB-360549 | nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingVDB-360549 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805510 | nextlevelbuilder ui-ux-pro-max-skill 2.5.0 Slide Generator Multiple Stored XSShttps://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/ n/a--Open5GS A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component. 2026-05-02 4.3 CVE-2026-7601 VDB-360558 | Open5GS AMF gmm-handler.c denial of serviceVDB-360558 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805675 | Open5GS v.2.7.6 Denial of Servicehttps://github.com/open5gs/open5gs/issues/4321https://github.com/open5gs/open5gs/commit/ebc66942b6f8f1fab2d640e71cf4e9f1a423b426https://github.com/open5gs/open5gs/releases/tag/v2.7.7https://github.com/open5gs/open5gs/ itsourcecode--Courier Management System A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. 2026-05-02 4.7 CVE-2026-7612 VDB-360569 | itsourcecode Courier Management System edit_user.php sql injectionVDB-360569 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #806275 | itsourcecode Courier Management System V1.0 SQL Injectionhttps://github.com/ltranquility/submit/issues/12https://itsourcecode.com/ ChatGPTNextWeb--NextChat A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-02 4.3 CVE-2026-7643 VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyVDB-360755 | CTI Indicators (IOB, IOC, IOA)Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policyhttps://github.com/ChatGPTNextWeb/NextChat/issues/6756https://github.com/ChatGPTNextWeb/NextChat/ n/a--crmeb_java A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7673 VDB-360826 | crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadVDB-360826 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800684 | crmeb crmeb_java 1.3.4 Unrestricted Uploadhttps://fx4tqqfvdw4.feishu.cn/docx/EgMOdHyq6oyxhux5vpJcr5cgnAf?from=from_copylink kerwincui--FastBee A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7676 VDB-360829 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalVDB-360829 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800723 | kerwincui FastBee ≤ 1.2.1 Path Traversalhttps://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink jsbroks--COCO Annotator A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7680 VDB-360833 | jsbroks COCO Annotator Data Endpoint datasets.py path traversalVDB-360833 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #801150 | jsbroks COCO Annotator 0.11.1 Absolute Path Traversalhttps://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter AMTT--Hotel Broadband Operation System A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7697 VDB-360866 | AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionVDB-360866 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #803272 | Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System v1.0 SQL Injectionhttps://github.com/testnet0/testnet/issues/74 Telegram--Desktop A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7701 VDB-360870 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceVDB-360870 | CTI Indicators (IOB, IOC, IOA)Submit #804341 | Telegram Telegram Desktop
Read more »
Thursday April 30
02:04 pm
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs | Krebs on Security
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.
Read more »
Monday April 27
04:22 pm
Vulnerability Summary for the Week of April 20, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow 94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001 OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763 HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605 IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907 hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/ Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95 Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0 Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech Back to top
Read more »
Tuesday April 21
02:53 pm
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty | Krebs on Security
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.
Read more »
Thursday April 16
03:28 pm
Most secure browser for Mac in 2026 | Intego Mac Security
Most secure browser for Mac in 2026
For most Mac users, your browser is where a lot of online life happens — reading emails, logging into accounts, using web apps, shopping, and banking. It’s also where a small mistake can lead to a bigger problem, whether that means downloading something that looked harmless or signing into a phishing page that seemed real […] The post appeared first on The Mac Security Blog.
Read more »
Tuesday April 14
09:47 pm
Patch Tuesday, April 2026 Edition | Krebs on Security
Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.
Read more »
Friday April 10
05:13 pm
Why more Mac attacks now rely on social engineering | Intego Mac Security
Why more Mac attacks now rely on social engineering
Recent security findings suggest a change in how Mac users are being targeted. Instead of searching for technical gaps in software, attackers are finding ways to ask users to run commands themselves. This pattern shows up across different reports, from fake apps that look legitimate to scam pages that guide users into pasting commands into […] The post appeared first on The Mac Security Blog.
Read more »
Tuesday April 07
07:01 pm
The new Intego Antivirus is here — everything you need to know about Intego ONE | Intego Mac Security
The new Intego Antivirus is here — everything you need to know about Intego ONE
Intego ONE is Intego’s new all-in-one Mac security app, built to make protection easier to manage in one place. Instead of juggling separate tools, you get antivirus protection, firewall protection, SmartClean, and VPN in one Mac-focused app, depending on your plan. If you’ve used Intego products before, the shift is straightforward — fewer moving parts […] The post appeared first on The Mac Security Blog.
Read more »
05:02 pm
Russia Hacked Routers to Steal Microsoft Office Tokens | Krebs on Security
Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
Read more »

Older posts

Tuesday March 24
02:59 pm
Introducing Apple Business — a new all-in-one platform for businesses of all sizes | Apple Newsroom
Introducing Apple Business — a new all-in-one platform for businesses of all sizes
Apple today announced Apple Business, a new all-in-one platform that allows companies to manage devices and reach more customers.
Read more »

Wednesday May 13
11:53 pm
Cloudflare Dashboard and API service issues | CloudFlare
Cloudflare Dashboard and API service issues
May 13, 23:53 UTCInvestigating - Cloudflare is investigating issues affecting the Load Balancer API and dashboard, along with delays in audit log delivery for some services. Customers may experience failed or delayed requests to the Load Balancer API, and some dashboard operations may return errors. The serving of cached content and other security features at the Cloudflare edge are not affected. We are working to mitigate this problem and will provide an update shortly.
Read more »
09:02 pm
[Fragnesia] Linux Privilege Escalation Vulnerability | Linode
[Fragnesia] Linux Privilege Escalation Vulnerability
May 13, 21:02 UTCInvestigating - Akamai is aware of the recently disclosed “Fragnesia”[1] vulnerability, following the “DirtyFrag”[2] and “CopyFail”[3] disclosures. This vulnerability is very similar in nature and has a similar impact, exploit path, and mitigation approach. We have not observed any related malicious exploits targeting our infrastructure and are continuing to address the vulnerability across our product portfolio and internal systems.As with “CopyFail” and “DirtyFrag”, we are advising customers to consider most Linux distributions to be at-risk until patched. Since the “Fragnesia” vulnerability was disclosed prior to upstream patches having been made available, we are forced to wait for the different OS providers to create new releases or patches before we can integrate them into the versions we make available to customers.As this is a rapidly developing incident, we will provide further information regarding recommended actions, possible mitigations, and OS updates for all customers who may be affected.[1] https://github.com/v12-security/pocs/tree/main/fragnesia [2] https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md [3] https://www.linode.com/docs/guides/cve-2026-31431-copy-fail-mitigation/
Read more »
08:22 pm
Browser Run API availability issues | CloudFlare
Browser Run API availability issues
May 13, 20:22 UTCIdentified - Cloudflare has identified the issue and is implementing a fix. We will update the status once we implement the fix.May 13, 20:16 UTCInvestigating - Cloudflare is investigating issues with Browser Run API. We are working to understand the full impact and mitigate this problem. More updates to follow shortly.
Read more »
07:22 pm
LogMeIn Rescue, Pro, and Central – Issue downloading Rescue and Pro/Central applets | GoToMeeting
LogMeIn Rescue, Pro, and Central – Issue downloading Rescue and Pro/Central applets
May 13, 19:22 UTCIdentified - Our engineers have identified the issue and are now actively working towards a resolution.We will provide another update shortly.May 13, 18:58 UTCInvestigating - We are actively investigating reports that some LogMeIn Rescue and Central customers may be experiencing issues downloading the applet to start or join remote sessions. Our engineers are working to identify the issue and will provide another update shortly.
Read more »
05:55 pm
RESOLVED: **Summary** Some Cameyo by Google customers could not start their sessions after rolling out the new channel version. **Description** We were experiencing an issue with Cameyo by Google, beginning on Tuesday, 12 May 2026 09:01 US/Pacific. The issue was mitigated on Tuesday, 12 May 2026 15:16 US/Pacific by restarting the RAP system service, and performing full server reboots. From preliminary investigation, this was caused by a faulty code for logging improvement on the Player VMs. Log files were unexpectedly duplicated until the disk was full leading to the session failures. Some customers were recovered automatically after the channel binaries were rolled back, while the others were required to restart their VMs manually. Currently, the issue is fully mitigated and change is rolled back. We apologise to those who were impacted by this issue. **Customer Symptoms** The customers were experiencing an issue that couldn’t connect to the Player VMs normally. The disk utilization on the affected VMs reaches 99% or even 100%. **Workaround** Not needed because all affected servers have been mitigated. | Google Apps
RESOLVED: **Summary** Some Cameyo by Google customers could not start their sessions after rolling out the new channel version. **Description** We were experiencing an issue with Cameyo by Google, beginning on Tuesday, 12 May 2026 09:01 US/Pacific. The issue was mitigated on Tuesday, 12 May 2026 15:16 US/Pacific by restarting the RAP system service, and performing full server reboots. From preliminary investigation, this was caused by a faulty code for logging improvement on the Player VMs. Log files were unexpectedly duplicated until the disk was full leading to the session failures. Some customers were recovered automatically after the channel binaries were rolled back, while the others were required to restart their VMs manually. Currently, the issue is fully mitigated and change is rolled back. We apologise to those who were impacted by this issue. **Customer Symptoms** The customers were experiencing an issue that couldn’t connect to the Player VMs normally. The disk utilization on the affected VMs reaches 99% or even 100%. **Workaround** Not needed because all affected servers have been mitigated.
Incident began at 2026-05-12 16:01 and ended at 2026-05-12 22:16 (times are in Coordinated Universal Time (UTC)).Summary Some Cameyo by Google customers could not start their sessions after rolling out the new channel version. Description We were experiencing an issue with Cameyo by Google, beginning on Tuesday, 12 May 2026 09:01 US/Pacific. The issue was mitigated on Tuesday, 12 May 2026 15:16 US/Pacific by restarting the RAP system service, and performing full server reboots. From preliminary investigation, this was caused by a faulty code for logging improvement on the Player VMs. Log files were unexpectedly duplicated until the disk was full leading to the session failures. Some customers were recovered automatically after the channel binaries were rolled back, while the others were required to restart their VMs manually. Currently, the issue is fully mitigated and change is rolled back. We apologise to those who were impacted by this issue. Customer Symptoms The customers were experiencing an issue that couldn’t connect to the Player VMs normally. The disk utilization on the affected VMs reaches 99% or even 100%. Workaround Not needed because all affected servers have been mitigated. Affected products: Cameyo by Google
Read more »
03:53 pm
OSL (Oslo) on 2026-05-14 | CloudFlare
OSL (Oslo) on 2026-05-14
THIS IS A SCHEDULED EVENT May 14, 07:30 - 17:30 UTCMay 13, 15:40 UTCScheduled - We will be performing scheduled maintenance in OSL (Oslo) datacenter on 2026-05-14 between 07:30 and 17:30 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
03:26 pm
Cache Purging and Cache Rule Update Issues | CloudFlare
Cache Purging and Cache Rule Update Issues
May 13, 15:26 UTCResolved - This incident has been resolved.May 13, 15:24 UTCInvestigating - Cloudflare has identified an issue affecting cache purge requests for Cache Reserve customers and updates to cache-related zone settings. Affected customers may see failures or timeouts when attempting to purge cached content or change cache rules via the Dashboard or API. Other Cloudflare services and cached content delivery are not affected. A fix has been identified and will be deployed shortly.
Read more »
02:49 pm
Increased HTTP 502 Errors in Hong Kong region | CloudFlare
Increased HTTP 502 Errors in Hong Kong region
May 13, 14:49 UTCInvestigating - Cloudflare is investigating an increased level of HTTP 502 errors impacting customers in Hong Kong region
Read more »
02:44 pm
Errors with Email Sending via the Worker Binding | CloudFlare
Errors with Email Sending via the Worker Binding
May 13, 14:44 UTCUpdate - We are continuing to investigate this issue.May 13, 14:39 UTCInvestigating - Cloudflare is investigating issues with Email Sending via the Worker Binding where an error message "Invalid email address: Invalid input" can be returned if the recipient list is an array.More updates to follow soon.
Read more »
02:38 pm
Increased HTTP 502 Errors in San Jose, CA, United States region | CloudFlare
Increased HTTP 502 Errors in San Jose, CA, United States region
May 13, 14:38 UTCMonitoring - A fix has been implemented and we are monitoring the results.May 13, 14:27 UTCInvestigating - Cloudflare is investigating an increased level of HTTP 502 errors impacting customers in San Jose, CA, , United States regionWe are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »
02:23 pm
IST (Istanbul) on 2026-05-13 | CloudFlare
IST (Istanbul) on 2026-05-13
THIS IS A SCHEDULED EVENT May 13, 23:30 UTC - May 14, 05:30 UTCMay 13, 14:08 UTCScheduled - We will be performing scheduled maintenance in IST (Istanbul) datacenter between 2026-05-13 23:30 and 2026-05-14 05:30 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
01:22 pm
Authentication failures | Duo Security
Authentication failures
May 13, 09:22 EDTInvestigating - We are currently investigating an issue causing limited authentication failures on DUO57 and are working to correct the issue as soon as possible.
Read more »
09:42 am
Connectivity Issue – NL-AMS | Linode
Connectivity Issue – NL-AMS
May 13, 09:42 UTCInvestigating - Our team is investigating an issue affecting connectivity in our NL-AMS data center. During this time, users may experience intermittent connection timeouts and errors for all services deployed in this data center. We will share additional updates as we have more information.
Read more »
05:53 am
GoToMyPC – Maintenance | GoToMeeting
GoToMyPC – Maintenance
THIS IS A SCHEDULED EVENT May 14, 05:30 - 07:00 UTCMay 13, 05:36 UTCScheduled - As part of our commitment to provide exceptional service and reliability to our customers, the GoToMyPC team will be conducting service maintenance on the following date and time listed below. Our team will be taking all appropriate actions to minimise service interruptions during this event.Date and Time: May 14th, 2026, 5:30 AM UTC to 7:00 AM UTC Purpose: This maintenance is to ensure and maintain system performance and stability.Duration: All maintenance will be performed within the 1-hour 30-minute maintenance window.What to expect: During the Maintenance, GoToMyPC customers may expect 5 minutes of downtime.We would like to thank you for your patience and understanding during this time.
Read more »
04:30 am
Network Congestion in BKK | CloudFlare
Network Congestion in BKK
May 13, 04:30 UTCResolved - Between 04:30 - 04:56 UTC customers reaching Bangkok, Thailand would have experienced an increase of 5xx errors and performance degradation due to congestion.
Read more »
03:55 am
Facebook Lead Ads Error: “Unsuported get request. Object with ID “…” does not exist, cannot be loaded due to missing permissions or does not support this operation” | Zapier
Facebook Lead Ads Error: “Unsuported get request. Object with ID “…” does not exist, cannot be loaded due to missing permissions or does not support this operation”
Status: InvestigatingWe are currently investigating a spike in errors affecting Facebook Lead Ads integrations. Users may experience failures when running Zaps connected to Facebook Lead Ads, with errors related to missing permissions or unsupported requests. Our integrations team is actively investigating the root cause and working toward a resolution. We will provide updates as soon as we have more information.
Read more »
12:57 am
Network Route Leak | CloudFlare
Network Route Leak
May 13, 00:57 UTCIdentified - One of Cloudflare's upstream transit providers is currently experiencing a route leak, impacting a subset of traffic reaching Cloudflare's network. Customers whose traffic traverses affected paths may experience connection timeouts or errors. We have identified the source and are working with the transit provider to resolve the issue.
Read more »
Tuesday May 12
09:20 pm
Cloudflare Zero Trust: Gateway Issues | CloudFlare
Cloudflare Zero Trust: Gateway Issues
May 12, 21:20 UTCResolved - This incident has been resolved.May 12, 21:00 UTCInvestigating - Cloudflare is investigating issues with the DNS resolver component within Gateway in our Chennai (MAA) and Mumbai (BOM) data centers. Performance and connectivity through Gateway may be impacted, and identity-based Gateway policies may not be enforced correctly for users in these regions. We are working to understand the full impact and mitigate this problem
Read more »
08:23 pm
Issue accessing the Cloudflare IP ranges page | CloudFlare
Issue accessing the Cloudflare IP ranges page
May 12, 20:23 UTCMonitoring - A fix has been implemented and we are monitoring the results.May 12, 19:57 UTCInvestigating - Cloudflare is investigating an issue with https://www.cloudflare.com/ips-v4. Customers attempting to view the published list of Cloudflare IPv4 ranges may receive an HTTP 500 error. This issue is limited to the IP-ranges page on www.cloudflare.com and does not affect Cloudflare's CDN, DNS, security, or any other production services. We are working to mitigate this problem
Read more »
07:20 pm
Network Performance Issues | CloudFlare
Network Performance Issues
May 12, 19:20 UTCMonitoring - A fix has been implemented and we are monitoring the results.May 12, 19:07 UTCIdentified - The issue has been identified and a fix is being implemented.May 12, 19:04 UTCInvestigating - Cloudflare is investigating issues with network performance near Johannesburg (JNB). We are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »

Older posts

Showcase

Kool Tools: Pegasus3 Symply Edition

Promise Technology and Symply have launched the Pegasus3 Symply Edition, the next generation of the Pegasus desktop RAID storage system. The new system combines 40 Gb/s Thunderbolt 3 performance with Symply's storage management suite. The Pegasus3 Symply Edition is a...

Kool Tools: TimeCache

The Rolling Stones told us that time was on our side (or at least Mick Jagger's side). That's not always true, but with TimeCache (http://www.pandaware.com/timecache/index.html) for Mac OS X from PandaWare we can at least keep track of it. With TimeCache -- now...

Kool Tools: PDF Editor for Mac

Editing PDF files on Mac OS X can be tough, but a product from AnyBizSoft, a Wondershare company focused on PDF solutions, simplifies the process. PDF Editor for Mac, integrates AnyBizSoft's existing PDF to Word conversion technology. It not only enables users to edit...

Kool Tools: Aunsoft’s Video Converter for the Mac

Aunsoft Video Converter for Mac (http://www.aunsoft.com/video-converter-mac/) is a US$35 Mac video converting tool you can use to convert just about any type of video for use on a variety of Apple devices. What's more, it also boasts a several editing features. This...

More Showcase

Scanners “By The Numbers”

Wednesday May 13
07:06 pm
Total Wireless Has One of the Most Aggressive iPhone 17e Deals Right Now | MacPrices.net
Total Wireless Has One of the Most Aggressive iPhone 17e Deals Right Now
Total Wireless is currently offering one of the more aggressive iPhone 17e deals available right now. Customers signing up for the carrier’s $60/month Total 5G+ Unlimited plan can get the phone for $0 per month over 24 months, effectively covering the full cost of Apple’s $599 MSRP iPhone 17e. Check the current Total Wireless deal here. If you’d rather buy the phone outright, Total is also offering $200 off the full retail price, dropping the iPhone 17e to about $399 with qualifying plans and port-in activation. That combination of upfront savings and financing flexibility makes this one of the stronger prepaid iPhone deals available right now. For the latest sales and deals, see our iPhone Price Tracker, updated daily.
Read more »
05:56 pm
MacBook Neo Still In Stock at Walmart While Apple Slips to 2–3 Week Delays | MacPrices.net
MacBook Neo Still In Stock at Walmart While Apple Slips to 2–3 Week Delays
The MacBook Neo continues to stay in stock across Walmart’s online store, even as availability tightens at many other retailers and Apple’s own delivery estimates have slipped to roughly 2–3 weeks for many configurations. Check current MacBook Neo availability at Walmart. What makes Walmart stand out right now is the combination of immediate availability, fast free shipping, and free local store pickup options (where available). For buyers who don’t want to wait weeks for Apple delivery windows, Walmart has quietly become one of the easiest places to actually get a MacBook Neo quickly. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.
Read more »
12:54 pm
Upgraded 32GB/1TB 14″ M5 MacBook Pros Drop Up to $300 Off at Amazon & B&H | MacPrices.net
Upgraded 32GB/1TB 14″ M5 MacBook Pros Drop Up to $300 Off at Amazon & B&H
Amazon and B&H are now offering major discounts on Apple’s upgraded 32GB/1TB 14-inch M5 MacBook Pro configurations, with the Silver model down to $1799 and the Space Black version at $1849, compared to Apple’s standard $2099 MSRP. That works out to savings of $250-$300 off, making these some of the strongest discounts we’ve seen so far on upgraded M5 MacBook Pro models. Check the deals at Amazon and B&H. B&H is also continuing to offer free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Sunday May 10
02:13 pm
New 32GB/1TB M5 14″ MacBook Pro Drops to $1849 at Amazon, $250 off! | MacPrices.net
New 32GB/1TB M5 14″ MacBook Pro Drops to $1849 at Amazon, $250 off!
Amazon is now offering Apple’s new 32GB/1TB M5 14-inch MacBook Pro for $1849, down from Apple’s standard $1999 MSRP. That’s a clean $250 discount on one of the more desirable upgraded configurations in the lineup. Check current pricing at Amazon here. Deals on upgraded MacBook Pro configurations tend to arrive more slowly than base models, which makes this one stand out a bit more than the typical entry-level sale. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Friday May 08
06:36 pm
B&H Undercuts Other Retailers on This 16″ M5 Max MacBook Pro Deal | MacPrices.net
B&H Undercuts Other Retailers on This 16″ M5 Max MacBook Pro Deal
B&H Photo currently has the 16-inch M5 Max MacBook Pro (18-core CPU/36GB RAM/2TB SSD) on sale for $3649, compared to Apple’s standard $3899 MSRP. That’s a solid $250 discount overall—and about $50 cheaper than the next-best Apple retailers right now. Check current pricing at B&H here. B&H also adds free 1–2 day shipping to most U.S. addresses, which makes this one of the quickest and easiest ways to get a high-end M5 Max MacBook Pro without paying full price. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.
Read more »
Thursday May 07
03:26 pm
MacBook Neo Stock Check: Which Retailers Have Apple’s New Neo Available Right Now? | MacPrices.net
MacBook Neo Stock Check: Which Retailers Have Apple’s New Neo Available Right Now?
MacBook Neo inventory is changing quickly, with some colors and configurations much easier to find than others. There are a few clear patterns in the current MacBook Neo inventory picture. Indigo and Silver models appear to be the easiest configurations to find right now, especially at Amazon, B&H Photo, and Walmart. If you want the fastest shipping, those colors are currently the safest places to start. The Citrus models, on the other hand, continue to look like the hardest MacBook Neo configurations to find. Several retailers are either showing limited stock or no availability at all, which suggests buyers looking for Citrus may need to check back often or move quickly when stock appears. See the latest stock status, shipping estimates, and retailer availability below, then visit our MacBook Neo Price Tracker for current prices and daily updates.
Read more »
Wednesday May 06
09:10 pm
Metro Drops iPhone 17 to $529.99 for Switchers | MacPrices.net
Metro Drops iPhone 17 to $529.99 for Switchers
Metro by T-Mobile is offering a strong upfront discount on Apple’s iPhone 17, dropping the price to just $529.99 when you open a new account and transfer your existing phone number. That’s $300 below the phone’s regular $829.99 price, making it one of the better no-trade-in iPhone 17 deals currently available. See Metro by T-Mobile's Deal Here For more iPhone deals across Apple retailers and wireless carriers, see our iPhone Price Tracker, updated regularly.
Read more »
03:10 pm
Space Black 14″ M5 MacBook Pros Drop Below Apple Pricing at Amazon & B&H | MacPrices.net
Space Black 14″ M5 MacBook Pros Drop Below Apple Pricing at Amazon & B&H
Amazon and B&H are both offering some of the best prices right now on Apple’s Space Black 14-inch M5 MacBook Pro lineup, with meaningful discounts on the 16GB/1TB and 24GB/1TB configurations. The 16GB/1TB model has dropped to $1539 at Amazon and $1549 at B&H versus Apple’s $1699 MSRP. The 24GB/1TB version is now $200 off Apple's MSRP, $1699 at Amazon and $1699 at B&H. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Monday May 04
03:35 pm
iPad Deals Hit Walmart — $50+ Off Apple’s Entry-Level Models | MacPrices.net
iPad Deals Hit Walmart — $50+ Off Apple’s Entry-Level Models
Walmart is now offering $50–$52 off Apple’s iPad lineup, bringing prices below Apple’s standard MSRP and making these models a bit more approachable right now. The base 11-inch iPad that typically sells for about $349 is now $299, which is one of the best consistent discounts we’ve seen on these newer models. Check current iPad deals at Walmart. Walmart also makes the buying process simple, with fast free shipping on online orders and the option for free local store pickup (if available in your area). That combination of price and convenience is what really stands out right now.For the latest sales and deals, see our iPad Price Tracker, updated daily.
Read more »
01:29 pm
MacBook Neo Now In Stock at Walmart — Fast Shipping & Easy Pickup Available | MacPrices.net
MacBook Neo Now In Stock at Walmart — Fast Shipping & Easy Pickup Available
The MacBook Neo is now fully in stock at Walmart’s online store, making it one of the easiest places right now to actually buy one without worrying about availability. Instead of hunting for specific configurations, you can go in, choose what you want, and check out without the usual friction. Check current MacBook Neo availability at Walmart.Walmart also makes the process simple once you decide—offering fast free shipping on online orders, along with the option for free local store pickup (if available in your area). That combination of full availability and easy fulfillment is what really stands out right now.For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.
Read more »
01:09 pm
13″ M5 MacBook Air Drops $150 at Amazon — Lowest Prices Across the Lineup | MacPrices.net
13″ M5 MacBook Air Drops $150 at Amazon — Lowest Prices Across the Lineup
13-inch M5 MacBook Air pricing has finally shifted, with Amazon now offering $150 off across the entire lineup. The popular 16GB/512GB model has dropped to about $949 from Apple’s $1099 MSRP, and higher-end configurations are seeing the same consistent discount pattern. Check current 13-inch deals at Amazon. The 16GB/1TB model is now around $1149 (down from $1299), while the 24GB/1TB version is about $1349 (down from $1499), giving you the same $150 savings no matter which configuration you choose. Browse all configurations here. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.
Read more »
12:34 pm
15″ M5 MacBook Air Drops $150 at Amazon & B&H — Lowest Prices Yet | MacPrices.net
15″ M5 MacBook Air Drops $150 at Amazon & B&H — Lowest Prices Yet
Amazon and B&H are now offering some of the best pricing yet on Apple’s 15-inch M5 MacBook Air lineup, with $150 discounts across multiple configurations. The popular 16GB/512GB model has dropped to about $1149 from Apple’s $1299 MSRP, and similar savings are showing up on higher storage and memory options as well. Check current deals at Amazon. B&H is matching these prices while adding a key advantage: free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. View current deals at B&H. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.
Read more »

Older posts

Wednesday May 13
08:41 pm
Apple 14″ MacBook Pro M5 Laptop w/ 24GB RAM (Late 2025) for $1,499 + free shipping | DealNews Laptops
Apple 14″ MacBook Pro M5 Laptop w/ 24GB RAM (Late 2025) for $1,499 + free shipping
B&H Photo Video offers the Apple 14″ MacBook Pro M5 Laptop w/ 24GB RAM (Late 2025) for $1,499. That’s a $250 low. Shipping is free. Buy Now at B&H Photo Video Features Apple M5 10-Core CPU 24GB RAM; 512GB SSD 14.2″ 3024×1964 Liquid Retina XDR Display MacOS Model: Z1KH000BZ
Read more »
04:00 pm
Apple iPad Savings at Best Buy + free shipping | DealNews iPads
Apple iPad Savings at Best Buy + free shipping
Best Buy is offering savings on Apple iPad Air (M3) and iPad Pro (M5) models, with discounts up to $250 off. Deals include the Apple iPad Air M3 11″ 128GB Wi-Fi + Cellular Tablet for $499 (down from $799, pictured). Free shipping is available on all orders. Shop Now at Best Buy Features Apple M3 […]
Read more »
12:53 pm
Apple Macbook Pro 9th-Gen. i9 16″ Laptop w/ 16GB RAM for $497 + free shipping | DealNews Laptops
Apple Macbook Pro 9th-Gen. i9 16″ Laptop w/ 16GB RAM for $497 + free shipping
Bag this 29% discount right now. It's well over $500 in brand new condition elsewhere. A 1-year Allstate warranty applies. Buy Now at eBay
Read more »
Tuesday May 12
03:05 pm
Apple 13″ M5 MacBook Air (2026) for $949 + free shipping | DealNews Laptops
Apple 13″ M5 MacBook Air (2026) for $949 + free shipping
Amazon offers the Apple 13″ M5 MacBook Air (2026) for $949. That’s the best price we could find by $50. Shipping is free. Buy Now at Amazon Features 13.6″ 2560×1664 display Apple M5 CPU 16GB RAM Mac OS Model: MDHE4LL/A
Read more »
12:26 pm
Refurb 10th-Gen. Apple iPad 256GB Tablet (2022) for $360 + free shipping | DealNews iPads
Refurb 10th-Gen. Apple iPad 256GB Tablet (2022) for $360 + free shipping
It's over $400 in brand new condition elsewhere. A 1-year Allstate warranty applies. Shipping is free. Buy Now at eBay
Read more »
12:12 pm
Refurb Apple MacBook Pro M1 10-Core 16″ Laptop (2021) for $760 | DealNews Laptops
Refurb Apple MacBook Pro M1 10-Core 16″ Laptop (2021) for $760
Get the Refurb Apple MacBook Pro M1 16-Core 16″ Laptop (2021) for $760. That’s the best price we could find by $19. Shipping is free and it’s backed by a one-year Allstate warranty. Buy Now at eBay Features Apple M1 Pro Chip with 10-Core CPU and 16-Core GPU 16GB RAM, 1TB SSD macOS
Read more »
09:44 am
Apple MacBook Top Deals at Best Buy: Up to 83% off + free shipping | DealNews Laptops
Apple MacBook Top Deals at Best Buy: Up to 83% off + free shipping
Save on almost 250 models, with prices starting from $270 for refurbs. We’ve pictured the Apple 14″ MacBook Air M4 Laptop w/ 1TB SSD for $1,299 ($300 savings). My Best Buy members get free shipping on all orders (it’s free to join). Shop Now at Best Buy
Read more »
Monday May 11
11:13 am
Refurb Apple MacBook Pro M1 Pro 16.2″ Laptop (2021) for $660 + free shipping | DealNews Laptops
Refurb Apple MacBook Pro M1 Pro 16.2″ Laptop (2021) for $660 + free shipping
At eBay, get the Refurb Apple MacBook Pro M1 Pro 16.2″ Laptop (2021) for $660. That’s a low by $40 and the second-beat price we’ve seen. It’s backed by a one-year Allstate warranty. Buy Now at eBay Features Apple M1 Pro CPU & 14-core GPU 16.2″ Liquid Retina XDR display 32GB RAM & 512GB SSD […]
Read more »
07:34 am
Apple Pencil Pro for $99 + free shipping | DealNews Accessories
Apple Pencil Pro for $99 + free shipping
Amazon offers the Apple Pencil Pro for $99. That's the second-beat price we've seen it at and a savings of $30. Shipping is free. Buy Now at Amazon Features squeeze to bring up a toolset (w/ haptic feedback) tilt & rotation detection works w/ Find My app Model: MX2D3AM/A
Read more »
06:51 am
Refurb Apple MacBook Deals at Woot for From $230 + free shipping | DealNews Laptops
Refurb Apple MacBook Deals at Woot for From $230 + free shipping
Woot has refurbished Apple MacBooks on sale, with Amazon Prime members qualifying for free shipping. The sale includes MacBook Air and MacBook Pro models from 2017 to 2022. One callout is the Apple 13.3″ MacBook Air with M1 Chip for $419.99. Ends May 23 2026. Buy Now at Woot! An Amazon Company
Read more »
Saturday May 09
04:16 am
Stylus Pen for Apple iPad (2018-2025) USB-C Charging Blue for $14.80 + free shipping w/ $35 | DealNews Accessories
Stylus Pen for Apple iPad (2018-2025) USB-C Charging Blue for $14.80 + free shipping w/ $35
Designed for note-taking, sketching, or general navigation on any compatible iPad from 2018 onward, this stylus charges via USB-C rather than requiring a separate adapter or battery. At $15, it's $8 off the list price. Buy Now at Walmart Features Draw without a glove for comfortable, natural hand placement Improve accuracy and control with direct screen contact Vary line thickness naturally using tilt angle Create expressive shading by changing stylus tilt Draw more precisely for detailed sketching and illustration
Read more »
04:09 am
Kenke iPad Case with Pencil Holder for $11 + free shipping w/ $35 | DealNews Accessories
Kenke iPad Case with Pencil Holder for $11 + free shipping w/ $35
Students, artists, or anyone using an iPad regularly for note-taking or drawing will find the built-in pencil holder useful for keeping their stylus from getting lost. At $11, that's about $1 off the list price. Buy Now at Walmart Features Fits iPad 11th Gen 11-inch (2025) and iPad 10th Gen 10.9-inch Sparkly clear back shows iPad while adding style Store Apple Pencil securely in dedicated side holder Raised camera and screen edges protect against scratches Slim, lightweight case stays clean and easy to wipe
Read more »
04:09 am
Aoub iPad 11″ Case with Pencil Holder for $11 + free shipping w/ $35 | DealNews Accessories
Aoub iPad 11″ Case with Pencil Holder for $11 + free shipping w/ $35
For students or professionals using an iPad 11″ who want their Pencil stored and accessible without a separate pouch or sleeve, this case handles both jobs in one. It’s currently $11, down from $12 list. Buy Now at Walmart Features Precision-fit for iPad 11th gen 11-inch and iPad 10th gen Protects with PU leather, microfiber […]
Read more »
04:03 am
Stylus Pen for iPad 2018-2025 White for $11 + free shipping w/ $35 | DealNews Accessories
Stylus Pen for iPad 2018-2025 White for $11 + free shipping w/ $35
Designed for anyone who uses an iPad for note-taking, sketching, or annotating documents, this stylus covers all iPad models from 2018 through 2025 and is currently $11 off the $21 list price. Buy Now at Walmart Features Works with iPad models 2018-2024 across Air, Mini, Pro Write up to 24 hours after 15-minute fast charge Magnetically attaches to iPad side for secure storage Palm rejection and tilt drawing without Bluetooth pairing 1.5mm POM tip delivers smooth, lag-free precision
Read more »
04:03 am
Stylus Pen for iPad 2018-2025 for $13 + free shipping w/ $35 | DealNews Accessories
Stylus Pen for iPad 2018-2025 for $13 + free shipping w/ $35
Designed for note-taking, sketching, or marking up documents on a compatible iPad, this stylus is worth a look for students or anyone who prefers writing by hand on screen. It's listed at $100 but currently priced at $13. Buy Now at Walmart Features Palm rejection prevents accidental touches while writing Tilt and pressure sensing enables natural shading and strokes Quick charge 5–20 minutes, lasts 8–10 hours 1.5mm replaceable tip installs tool-free for precision Works without Bluetooth; tap button to power on
Read more »

Older posts

No feed items found.