All the Liquid Glass Changes in macOS Golden Gate
When Liquid Glass launched in macOS Tahoe, Apple faced criticism over how the design looked on the Mac. Some people felt that Liquid Glass in ‌macOS Tahoe‌ was an afterthought with little impact from the design update, while others had issues with contrast, readability, rounded corners, and design consistency. There were long complaint threads on the MacRumors forums and on Reddit, and some people refused to update. Apple is making several changes to Liquid Glass and the overall macOS Golden Gate design, and while subtle, some of the changes could make Liquid Glass on Mac easier to digest. Transparency and Diffusion Apple added a full Liquid Glass slider under System Settings > Appearance. It changes the translucency of Liquid Glass elements, and users can choose a clear version of Liquid Glass that allows some of the background to show through, select a more opaque, tinted version that improves the legibility of text, or choose something in between. Unfortunately, there is no ultra-clear version of Liquid Glass available with the slider. Even the setting that's as clear as possible does not match the original version of Liquid Glass that Apple showed off at WWDC 2025. Apple changed the overall Liquid Glass opacity, and it now diffuses complex content more effectively. Apple says a darkened edge and brighter specular highlights establish more depth and separation for the UI. Toolbars and Window Shapes Apps have uniform toolbars to make text headings and groups of controls more legible. Windows also all have the same corner radius for more consistency between apps. ‌macOS Tahoe‌ Corners of apps are not as dramatically rounded in ‌macOS Golden Gate‌, and the difference is noticeable. ‌macOS Golden Gate‌ It's easier to tell when a window is active because of the sidebar design, the opacity update, and changes to window shadows. Sidebars Sidebars are no longer floating and are instead edge-to-edge. It's a design that's less distracting and more uniform because there's no unnecessary sidebar shadowing that just takes up space. Sidebar icons have color again, which is something Apple removed in ‌macOS Tahoe‌. Icons Apple didn't budge on requiring squircle Mac icons, but it did change icon design. Icons have more layers of Liquid Glass to improve detail and sharpness in light, dark, tinted, and clear icon modes. Apple is also using icons for some menu bar items to make it easier to find commonly used actions. HDR Apple is using HDR for depth and dimension in the ‌macOS Golden Gate‌ interface. Launch Date ‌macOS Golden Gate‌ also includes all of the new Siri AI features coming in iOS 27, along with performance improvements that make the Mac feel faster. The update is limited to developers right now, but Apple plans to release a public beta in July. ‌macOS Golden Gate‌ will launch this fall. Related Roundup: macOS Golden GateThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases New AirPods Beta Firmware With iOS 27 Features
Apple today released new beta firmware for the AirPods 4, AirPods Pro 2, and AirPods Pro 3. The firmware is limited to developers at the current time, and it has a build number of 9A5292e. In iOS 27, iPadOS 27, and macOS Golden Gate, Apple is adding a new AirPods interface and support for custom EQ. AirPods are also compatible with the new Siri AI. With iOS 26, iPadOS 26, and macOS Tahoe, Apple added a beta firmware update installation option that's available from the AirPods settings interface when the AirPods are connected to an iPhone, iPad, or Mac, which facilitates beta testing. Developers can use the beta option to turn on beta downloads.Related Roundups: AirPods 4, AirPods Pro 3, iOS 27Buyer's Guide: AirPods (Caution), AirPods Pro (Neutral)Related Forum: AirPodsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Says iOS 27 Adds These 12 New Features to Your iPhone
iOS 27's key new feature is a more intelligent and personal version of Siri, but the changes go well beyond that. In a press release today, Apple outlined additional enhancements coming across Apple Maps, Find My, Apple Wallet, Apple Music, and more. Apple Maps has gained an enhanced Flyover experience powered by AI, enabling you to view aerial imagery in "stunning detail" for select cities. In the U.S., Apple Maps has also received a new Local Lists feature, which surfaces things such as trending restaurants and kid-friendly places to visit. In the Find My app, you will have the ability to share your location with others for a custom duration, such as four days and six hours. Or, you can set a set an exact date and time for your location sharing to expire. In addition, you can now pause your location sharing with specific people until the end of the day. On iOS 26 and earlier, there are only three preset timeframes available: indefinitely, until end of day, and one hour. In the U.S., iOS 27 allows you to split bills with a new feature powered by Apple Cash and Apple Intelligence. This capability is available in the Messages and Apple Wallet apps, or by using the new Siri mode in the Camera app. "When users point their iPhone at a receipt using Siri mode, it can surface the relevant action to split a bill with Apple Cash and identify the items on the receipt," said Apple. "As users select their items, their total payment is calculated, including their share of tax and tip, so they can pay back exactly what they owe with Apple Cash." You can now create custom passes in Apple Wallet from physical cards, like loyalty or membership cards. With the Siri mode in the Camera app, you can simply point your iPhone at any physical card with a barcode and save it to Apple Wallet. Once added, passes are ready to present as a barcode or QR code right from the iPhone. iOS 27 provides an enhanced Apple Wallet key experience for participating hotels and resorts. You can view more details about your trips, receive updates about booked activities, access services available during your stay, and more. Apple Pay's checkout flow on the web and in apps is getting an updated design that allows you to swipe to switch payment cards. And if you have an eligible card in Apple Wallet, it will be accompanied by more information, including rewards balances, debit account balances, pay later options, and more. As part of the Tap to Pay on iPhone feature, new Tap to Share functionality allows you to connect to a participating small business owner's iPhone and securely share shipping information, email addresses, loyalty rewards, and more. In the Apple Podcasts app, there is a new "search within show" feature. In the Photos app, iCloud Shared Albums now support full-resolution sharing, more file types, emoji reactions, and more. Even people without an Apple device can now join and contribute photos to these shared albums on the web. In the Apple Music app, Apple said the AutoMix feature has "even better transitions" that feel "more immersive and engaging for listeners." Introduced in iOS 26, AutoMix adds seamless, DJ-like transitions between songs. Apple Music's Lyrics Translation feature is expanding to seven additional language pairings: English to French, English to German, English to Italian, English to Korean, English to Spanish, French to English, and Japanese to English. Apple's press release provides more details about these features and a few others. iOS 27 is currently available in developer beta, with a public beta to follow in July. The update is expected to be released in September.Related Roundup: iOS 27Tags: Apple Maps, Apple Music, Apple Wallet, Find MyThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

macOS 27 Finally Brings Direct Touch Control to Sidecar
Apple has added direct touch input to Sidecar with macOS 27 Golden Gate and iPadOS 27, allowing users to tap and interact with macOS interface elements using a finger on their iPad for the first time. Previously, ‌Sidecar‌ was deliberately limited as a touch interface. While multi-touch gestures like two-finger scrolling, pinch-to-zoom, and three-finger editing gestures for copy, cut, paste, and undo have been supported for years, directly tapping to click links, open apps, or interact with macOS UI elements was not possible with a finger. Those interactions required either the Mac's connected mouse or trackpad, or an Apple Pencil. The new Direct Touch capability closes that gap. In ‌macOS 27‌, users can can now tap, swipe, and interact with macOS apps on their ‌iPad‌ screen using a finger, bringing ‌Sidecar‌ closer to how third-party tools like Luna Display have worked for some time. ‌Apple Pencil‌ support continues alongside the new touch capabilities. ICYMI: You can now use touch controls on your Mac display with Sidecar on iPad! 👀 pic.twitter.com/KOErLtoZCA— BLCNYY (@BLCNYY) June 9, 2026 The expanded ‌Sidecar‌ functionality requires an Apple Silicon Mac running ‌macOS 27‌ Golden Gate and a compatible ‌iPad‌ running iPadOS 27. As with previous versions of the feature, both devices must be signed into the same Apple ID, connected to the same Wi-Fi network, and have Bluetooth enabled, with the two devices within 10 meters of each other. The feature is likely another indication of impending touch support on the Mac, along with other features like pull-to-refresh. Apple is said to be planning to launch a "MacBook Ultra" as a new top-tier laptop with a touchscreen OLED display, an M6-series chip, the Dynamic Island, and a thinner design. Reports suggest that the device is scheduled to launch in early 2027.Related Roundup: macOS 27Tag: SidecarThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Nomad's New Stellar Orange Charger and Find My Card Match the iPhone 17 Pro
Nomad today introduced two new products in its Stellar Orange colorway, expanding the number of accessories it offers in the unique shade. Stellar Orange matches the Cosmic Orange color that Apple used for the iPhone 17 Pro and ‌iPhone 17 Pro‌ Max. The Stellar Orange Stand One is a 2-in–1 charging stand that's priced at $135. It was previously available in silver and carbide, but it now comes in bright orange. It is a Qi2 charger that charges a MagSafe iPhone at up to 25W. The upright charger supports charging an iPhone in portrait or landscape orientation for Stand By, and it has a quality glass and metal build. A second Qi charger at the bottom of the stand allows AirPods to be charged at 5W. The stand charges over USB-C, and you'll need to supply a 40W or better power adapter, but it does come with a braided nylon USB-C cable. An anti-slip base keeps it in place, as does the weight of the charger. Nomad's Stellar Orange Tracking Card Pro is $39, and it is made to slip into a wallet to add Find My tracking capabilities. It connects to the ‌Find My‌ network so it is locatable in the ‌Find My‌ app's Items tab, and it can use nearby Apple devices to report its location if lost or stolen. The Tracking Card Pro can charge using any Qi or ‌MagSafe‌ charger, and the battery lasts for up to 16 months. It is 2.5mm thin, which makes it three times thinner than an AirTag and better suited for use in a wallet. It does not support Precision Finding because Apple doesn't make the iPhone's Ultra Wideband chip available to third-party trackers. Nomad's $135 Stellar Orange Stand One and $39 Stellar Orange Tracking Card Pro are available from the Nomad website as of today. Note: MacRumors is an affiliate partner Nomad. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.Related Roundup: iPhone 17 ProTags: Find My, NomadBuyer's Guide: iPhone 17 Pro (Caution)Related Forum: iPhoneThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

visionOS 27: Siri AI, Eye-Aware Notifications, Curved Windows, and More
Apple's WWDC 2026 keynote may have seemed relatively quiet on the Vision Pro front, but the visionOS 27 beta contains a decent amount of new features and quality of life improvements that are likely to be welcomed by the headset's user base. As you'd expect, visionOS 27 is getting the new Apple Intelligence and Siri AI features that Apple has brought to iOS 27 and macOS 27, but this time they feel more seamlessly integrated into the platform compared to previous efforts. For example, Vision Pro users can ask ‌Siri‌ about anything in their surroundings, and using Visual Intelligence, the assistant will see and interpret it in real time, identifying the content, answering questions about it, and providing contextual information to boot. Interacting with Apple's ‌Siri‌ is achieved via a new 3D orb that users can place anywhere in their virtual space, and just looking at the widget is enough to start a conversation – no "Hey ‌Siri‌" needed. A new ‌Siri‌ app also makes it easier to revisit previous interactions and continue conversations. Curved windows in visionOS 27 Below is a summary of what else is new in visionOS 27: Panoramas as environments: Panorama photos can now be turned into immersive spatial environments. Rather than viewing panoramas as flat images, users can step into them and experience added depth and realism, making photos and landscapes feel more lifelike. Curved app windows: Apps such as Safari, Freeform, and Apple TV now take advantage of new curved window layouts that wrap content around a user's field of view. The feature is designed to create a more immersive workspace and make better use of Vision Pro's virtual display area. Faster Wi-Fi: Apple says visionOS 27 significantly improves wireless performance, with supported networks delivering speeds up to three times faster than before. Safari 3D environments: A new Web Environments feature means developers can now use a new immersive API to launch users into a full 360-degree environment from within Safari. Apple says these environments can completely surround a user's physical space, making browsing feel more like a native Vision Pro experience. Redesigned Control Center: Control Center has been reorganized with dedicated sections for notifications and media playback, system controls, and immersive environments. The redesign aims to make common controls easier to find and reduce the number of steps required to access frequently used settings. Smaller widgets: A new extra-small widget size allows users to place more widgets throughout their physical space without overwhelming their environment. The additional size option gives users greater flexibility when placing clocks, weather widgets, photos, and other persistent spatial content. Glance-to-expand notifications: Notifications will now automatically expand when a user looks at them, thereby reducing the need for hand gestures or manual interaction. The feature means quicker access to information, while remaining in line with visionOS's eyes-first interaction model. Spatially preview your Mac: Mac owners can now preview and edit 3D models from their laptop directly in visionOS, while Quick Look enhancements allow for annotations to be added directly to 3D models. New Environment: Apple has added a new immersive environment based on Thórsmörk, a nature reserve in Iceland known for its dramatic mountains, valleys, and glaciers. Users can select the environment as a virtual backdrop for work and entertainment, just like the existing environments. Developer enhancements: Apple is introducing new frameworks, APIs, and tools to help developers build more advanced spatial experiences. The updates include RealityKit improvements, Environment Occlusion for more realistic blending of virtual and physical objects, enhanced asset rendering technologies, updates to Reality Composer Pro 3, and improvements for popular game engines. The new Control Center design for visionOS 27 The visionOS 27 developer beta is available now, ahead of the software's full release this fall. Apple says ‌Siri‌ AI will begin rolling out later this year as a beta feature and will initially support English only. However, unlike on iPhone and iPad, where ‌Siri‌ AI will not be available at launch in the European Union, Vision Pro users in the EU will have access to the feature from day one.Related Roundup: Apple Vision ProTag: SiriBuyer's Guide: Vision Pro (Neutral)Related Forum: Apple Vision ProThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 27 Fixes Justin Bieber's Problem
Last year, singer Justin Bieber turned to social media to complain about the placement of the dictation button in the Messages app's text field on the iPhone, and Apple has seemingly listened. iOS 27 lets you turn off the dictation button in the Settings app under Apps → Messages → Show in Text Field.Related Roundup: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

macOS 27 Golden Gate Adopts iPhone-Like Pull-to-Refresh Support
macOS 27 Golden Gate adds pull-to-refresh support to the Mac, adopting one of iPhone and iPad's most familiar gestures for the first time. The feature, which Apple calls "Swipe down to refresh," lets users swipe down within apps to fetch the latest content, rather than relying on a keyboard shortcut or menu item. Apple confirmed that Safari, Mail, News, Podcasts, and Calendar are among the apps that support the gesture at launch. Pull-to-refresh has been a staple of iOS and iPadOS for many years, offering an intuitive, gesture-driven way to update app content. Its arrival on macOS suggests Apple is continuing to blur the interaction patterns between its platforms. Apple is reportedly planning to launch a "MacBook Ultra", a new top-tier laptop expected to feature a touchscreen OLED display with an M6-series chip, the Dynamic Island, and a thinner design. Reports suggest early 2027 is the most likely launch window, following delays attributed to the global memory chip shortage. Touch-friendly interface updates to macOS are almost certainly related to that future product.Related Roundup: macOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Shares 5-Minute WWDC Platforms State of the Union Recap Video
Apple has published a five-minute recap video summarizing the key announcements from its WWDC26 Platforms State of the Union, covering rebuilt intelligence frameworks, platform design changes, and major developer tools updates. Apple said its Foundation Models have been rebuilt from the ground up in collaboration with Google, leveraging technology from the Gemini family of models. The Foundation Models framework now supports image input and cloud model integration, allowing developers to connect to any cloud model provider for more complex tasks. New dynamic profiles are also included to simplify building AI agents and skills by swapping tools in and out and updating instructions on the fly. Core AI, an entirely new framework for running on-device models, is built into the OS and designed to take full advantage of Apple Silicon. App Intents have been updated to connect apps to Apple Intelligence, making content discoverable and actions available through Siri via natural language, with a new View Annotations API allowing users to act on what's on screen just by asking. The refined Liquid Glass design system features prominently in the recap. Apple said the design is more consistent and personalizable, with better readability. On macOS, every window now shares a tighter corner radius. App icons receive sharper rendering automatically, with new refraction effects available through Icon Composer. iOS apps are now resizable, allowing users to take advantage of larger displays when running them on iPads or Macs via iPhone mirroring, with a new resizable iOS Simulator to make testing across sizes easier. SwiftUI received a range of updates, including drag-to-reorder and swipe actions in any container, nested layouts that resize up to twice as fast, and automatic async image caching. Toolbars now offer finer control over visibility as space shrinks, and a new Spatial Preview Framework for the Apple Vision Pro lets developers stream 3D models from a Mac into physical space. In Xcode 27, projects load faster and the app is 30% smaller as it moves to Apple Silicon-only. Settings now sync via iCloud, the toolbar is fully customizable, and themes including Emerald, Neon Noir, and Coral Reef bring color throughout the app. Xcode Cloud is easier to set up with builds up to twice as fast. A new Device Hub replaces Simulator, bringing virtual and physical devices together in one place with live resizing and full hardware control from the Mac. Apple said it is working with Anthropic, OpenAI, and Google to bring their agents into Xcode. Agent conversations now behave like files and can be opened, split, and stacked in the Navigator. Agents can run tests, use Playgrounds, customize previews across light and dark mode and other configurations, and drive a running app end-to-end. Developers can extend Xcode further through plugins that bring skills, MCP tools, and agents via the agent-client protocol, with Figma and GitHub shipping their own plugins at launch. The full Platforms State of the Union video is available on the Apple Developer app, website, and YouTube.Related Roundup: WWDC 2026Tag: WWDC 2026Related Forum: Apple, Inc and Tech IndustryThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Podcasts Gets Video on Mac and Apple TV, Plus New Search Feature
Apple yesterday announced several improvements to Apple Podcasts, including video podcast playback on macOS and a fully redesigned tvOS app. Mac users will gain a new, enhanced video podcast experience in ‌Apple Podcasts‌, including Picture in Picture support for watching episodes while multitasking. The update brings the full mobile ‌Apple Podcasts‌ experience to the Mac, with audio and video content alongside transcripts, timed links, and chapters. The ‌Apple Podcasts‌ app on tvOS is receiving a complete redesign with video podcast playback, a new sidebar navigation for easier browsing, and support for podcast creators' episode and show artwork. The update is aimed at making it simpler to discover and enjoy video content on the big screen. Across iPhone, iPad, Mac, and Apple Vision Pro, as well as on the web at podcasts.apple.com, Apple is also adding a new search within show feature. The tool allows users to search directly within a show from its See All Episodes view, making it easier to locate a specific episode without scrolling through an entire back catalog. The updates will arrive this fall as part of iOS 27, iPadOS 27, visionOS 27, macOS 27 Golden Gate, and tvOS 27.Related Roundup: Apple TVTag: Apple PodcastsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Reveals How Many iPhones Were Running iOS 26 Before WWDC
Apple has shared updated iOS 26 and iPadOS 26 adoption figures, revealing how many iPhones and iPads were running those software versions on the day before the start of WWDC 2026 and the release of the first iOS 27 developer beta. These adoption numbers are based on iPhones and iPads that transacted on the App Store on Sunday, June 7, according to Apple. The statistics are as follows:86% of all iPhones introduced in the last four years were running iOS 26. 79% of all iPhones were running iOS 26. 79% of all iPads introduced in the last four years were running iPadOS 26. 68% of all iPads were running iPadOS 26.Here is how that compares to the iOS 18 adoption figures that Apple shared based on iPhones and iPads that transacted on the App Store on Thursday, June 5, 2025:88% of all iPhones introduced in the last four years were running iOS 18. 82% of all iPhones were running iOS 18. 81% of all iPads introduced in the last four years were running iPadOS 18. 71% of all iPads were running iPadOS 18.iOS 27 beta testing is now underway, so this will be Apple's final update on iOS 26 adoption.Related Roundups: iOS 26, iPadOS 26, WWDC 2026Tag: iOS AdoptionRelated Forums: iOS 26, Apple, Inc and Tech IndustryThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

EU Says Decision Not to Launch Siri AI in Europe Is Apple's Alone
The European Commission has responded to Apple's announcement that Siri AI will not launch in the EU, saying the decision is entirely Apple's and that the company sought an exemption from its legal obligations rather than a compliant solution. Commission spokesperson Thomas Regnier told reporters in Brussels (via Reuters) that Apple had failed to develop interoperability solutions meeting EU privacy and security standards, and instead asked to be let off the hook entirely. The decision not to roll out Siri AI in the EU is Apple's and Apple's only. Apple was simply unable to develop interoperability solutions that meet essential EU privacy and security standards. Instead of trying to find a suitable compliance solution, Apple simply made a request to the European Commission to be exempted from their interoperability obligations. That's not an option. The statement appears to contradict Apple's characterization of events somewhat. Apple announced yesterday that Siri AI would not be available in the EU on iOS or iPadOS, blaming regulators for refusing to engage constructively on proposed solutions. Craig Federighi, Apple's senior vice president of Software Engineering, said the company was "deeply disappointed" and cited what it described as regulators' refusal to accept any of Apple's proposals, including a system called Trusted System Agent that would have allowed third-party virtual assistants to safely access the same device capabilities as ‌Siri‌ AI. The Commission's account tells a different story. Rather than negotiating over Apple's proposed solutions, regulators say Apple simply requested a blanket exemption from its interoperability obligations under the Digital Markets Act, something the Commission says is not an available option. Apple's statement framed the DMA's requirements as demanding that any AI system be given "nearly unlimited access" to a user's device. When iOS 27 and Apple's other major new software updates are released later this year, users in the EU will not have access to ‌Siri‌ AI or any of its new features, including the app for revisiting and starting new conversations. Apple said it hopes to eventually bring ‌Siri‌ AI to the EU and will continue to engage with regulators, but offered no timeline.Tags: European Commission, European Union, Siri, Siri AIThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple's New AI Models Contain 'None' of Google's Gemini Assistant
Apple executives have detailed the architecture of the company's new Apple Foundation Models (AFM) and clarified exactly how Google's technology factored into their development. Craig Federighi, Apple's SVP of Software Engineering, held a post-keynote tech talk (via 9to5Mac) with press on Monday alongside AI VP Amar Subramanya, Siri lead Mike Rockwell, and software VP Sebastien Marineau-Mes to walk through how the third-generation AFM family was built and how it powers Apple Intelligence. "The amount of the Google Assistant we use is none," Federighi said, explaining that Apple uses none of the Gemini models deployed to Google's customers, none of Google's client-side code, and no Google Search infrastructure as the knowledge backbone. Of course, we don't have the Gemini app as our app. In fact, none of that client code is part of how we run on iOS. For these models, we use none of the models that Google deploys to their customers, nor do we use the infrastructure and means by which they deploy models to their customers. And then, when it comes to the knowledge base, we of course don't use Google Search or anything like that as the foundation of our system. Subramanya outlined the new AFM family, which spans two on-device models and three server-side models. The on-device tier consists of AFM Core, a next-generation dense architecture model, and AFM Core Advanced, which uses a sparse architecture and is natively multimodal. Subramanya said AFM Core Advanced is "unlike any on-device model we've run before," enabling new features including invitation and expressive voices without any cloud requests. On the server side, AFM Cloud handles latency-optimized Private Cloud Compute requests, while AFM Cloud Image powers image generation and editing features including spatial reframing. The key detail on the Google collaboration came in Subramanya's description of how these four models were trained. "All of these are custom built for Apple Silicon, trained using proprietary data with reinforcement learning and refined using outputs from Gemini frontier models," he said, making clear that Google's contribution was distillation-based, not a wholesale adoption of Gemini. The fifth and most capable model, AFM Cloud Pro, is designed for agentic tool use and complex reasoning tasks, with quality that Subramanya said is "similar to Gemini frontier models." This model marks a departure from Apple's standard Private Cloud Compute setup. To run it, Apple worked with both Google and Nvidia to extend its private cloud infrastructure to Nvidia GPUs hosted in Google's cloud. Marineau-Mes said Apple wanted to use Nvidia's latest chips but required them to be configured so they couldn't read the contents of Apple's servers. A recent Nvidia technology called "ambiguous confidential compute" provided the solution. We wanted to avail ourselves of the latest technology from Nvidia, and so we set out to extend private cloud compute to third-party cloud. Federighi described the broader system architecture as being organized around a System Orchestrator, a piece of software he called "key to the privacy architecture of our entire system." The orchestrator routes any given query to the appropriate model, on-device or cloud, based on the complexity of the request and the personal context required. It draws on an App Toolbox for in-app actions, a Spotlight Semantic Index for personal content, and on-screen context for real-time awareness. For queries involving current events, responses are found through Apple's own World Knowledge Service, which Federighi said the company has been building for several years. Apple also maintains that all Private Cloud Compute infrastructure, including the extended Nvidia GPU capacity in Google's cloud, can be independently verified by third-party researchers to confirm that user data is never stored or accessed.Tags: Apple Intelligence, Craig Federighi, GoogleThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iCloud+ Subscribers to Get Higher Apple Intelligence Usage Limits in iOS 27
Certain Apple Intelligence features in iOS 27 will carry daily usage limits, with iCloud+ subscribers receiving higher allowances than free users. The company reiterated the details in its press release accompanying yesterday's ‌Apple Intelligence‌ announcements. Apple said the limits apply to features that rely on "powerful server models," with image generation cited as the primary example. According to Apple, increased access will be available with most ‌iCloud‌+ subscription plans. Some Apple Intelligence features, including image generation, have daily usage limits because they rely on powerful server models. Increased access is available with most iCloud+ subscription plans, which also include Apple Intelligence support for compatible Home cameras. The phrase "most ‌iCloud‌+ plans" suggests the cheapest tier, priced at $0.99 per month, may not qualify for the higher limits. Subscribers on any higher ‌iCloud‌+ tier, or those with an Apple One bundle, appear to be in line for expanded access to advanced AI image generation and potentially other server-reliant features. ‌iCloud‌+ subscribers will also gain additional benefits in the Home app, including upgraded support for HomeKit Secure Video on compatible smart cameras.Related Roundup: iOS 27Tags: Apple Intelligence, HomeKit Secure Video, iCloudRelated Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Music Gains AutoMix Upgrades and More in iOS 27
Apple yesterday detailed several updates coming to Apple Music in iOS 27, including redesigned artist and album pages, an upgraded AutoMix feature, and a suite of performance improvements. The most immediately visible change is a refreshed artist page, which now features a prominent shuffle play button, a new artist name display, and various other layout adjustments. Apple also says album pages have been updated, though no visible changes are apparent in the first ‌iOS 27‌ developer beta. AutoMix, Apple's AI-powered feature that blends songs using matching key and tempo, has also been upgraded. Apple says it has improved the underlying algorithms to generate new transition types, making for more seamless blends between tracks. The standard Crossfade option remains available for users who prefer it. Apple says ‌iOS 27‌ improves the "reliability of ‌Apple Music‌ streaming." Apple has additionally improved the speed at which the Now Playing view loads, as well as the time it takes for streaming playback to begin from a fresh launch, both of which should make the app feel more responsive overall. Users can also now swipe away the Now Playing widget on the Lock Screen to dismiss it. ‌Apple Music‌ gains deeper integration with the all-new Siri AI in ‌iOS 27‌. Users can ask ‌Siri‌ about an artist and then follow up with natural commands such as "play one of her new singles" mid-conversation to kick off a playback session without breaking the flow.Related Roundup: iOS 27Tag: Apple MusicThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 27 Introduces Overhauled AirPods Settings Menu
When AirPods owners connect to their iPhone running iOS 27, they'll see a completely revamped settings menu for their earbuds that does a better job at organizing all of the feature options that Apple has added over the last few years. In the first iOS 27 developer beta, released on Monday, the new settings menu can be accessed in the same way as the old one – i.e. by appearing only when your AirPods are paired with your iPhone – but the menu itself is now a lot more easy to navigate. Apple has added a volume slider under the Listening Mode toggles, while the Hearing Health, Call Controls/Camera Control, Live Translation and Adaptive Audio sections have been condensed into separate menus identified by new icons: Accessibility, Audio & Routing, Hearing Health, and Controls & Gestures. There are also new menus for Battery, Privacy, and Find My options. The new design makes the AirPods settings menu a lot more compact, and it no longer feels like you have to endlessly scroll to try and find the option you're after. Apple has also implemented the redesign in System Settings for macOS 27 Golden Gate. Apple plans to release a public beta version of iOS 27 and macOS 27 next month, with a general release of the updates expected in the fall.Related Roundups: AirPods 4, iOS 27Buyer's Guide: AirPods (Caution)Related Forum: AirPodsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

BenQ MA320UG Review: A 32-Inch 4K 120Hz Display Made for Macs
BenQ is expanding its display lineup with the MA320UG, a 32-inch 4K 120Hz display designed for Mac users. BenQ's new $830 display connects to a Mac using Thunderbolt 4, and provides up to 96W charging. The MA320UG has an appealing design with a silver aluminum stand and a round height-adjustment arm that has up to 150mm of travel. It can be used in landscape or portrait mode by rotating, and the bottom of the base has a rubber pad where a Mac can sit. It has tilt and swivel functionality for getting an ideal viewing angle. There are slim bezels at the sides and top of the display, and a thicker bezel at the bottom. There's an upstream Thunderbolt port, a downstream Thunderbolt port to daisy chain a second display, two USB-C ports (one with 35W charging), two USB-A ports, and two HDMI ports at the back of the display. An always-on charging mode lets devices charge when the display is turned off, and there are two speakers included. Speakers in displays are generally not great, and that's the case here. The sound is fine, but if you want good sound, use your Mac's speakers or get external speakers. The 96W charging was enough to keep my MacBook Pro topped up, even though the ‌MacBook Pro‌ can draw up to 140W. I tested the MA320UG with a 16-inch ‌MacBook Pro‌, and it's always tricky evaluating a 4K display next to a ‌MacBook Pro‌ display, because it's never going to look as crisp. A 4K 32-inch display is about 138 pixels per inch (PPI), while my ‌MacBook Pro‌ display is 254 PPI. With BenQ's display software, the MA320UG can be set to 2560x1440, which is the default, 3840x2160, or a lower resolution. The lower the resolution, the larger the on-screen elements. I find 3840x2160 to be too small, and 2560x1440 to be too big, so there's no real sweet spot. The software doesn't allow for it, but I used my Mac's settings for a 3008x1692 resolution for a more consistent UI size with my ‌MacBook Pro‌. Text on the MA320UG is slightly fuzzier than on the ‌MacBook Pro‌'s display at the three higher resolutions I tested, but it's still entirely readable with HiDPI for Retina scaling. I don't notice the difference when I'm absorbed in work, but if I sit and stare at both displays, I can see the softness of the text on BenQ's display. I know some people are bothered by the disparity, but it's not something I think about unless I concentrate on it. HDR video in BenQ's HDR mode is where I can see the biggest difference between the MA320UG and the ‌MacBook Pro‌. The ‌MacBook Pro‌'s display is much brighter and the contrast ratio is higher, so it wins out when it comes to color variation and detail. Everything has more depth on the ‌MacBook Pro‌ display. If I'm not sitting at my desk and looking at the same HDR video on both displays at the same time, the MA320UG is totally fine, and I don't know what I'm missing. If I look at the MA320UG alone, it looks great. The MA320UG has a 120Hz refresh rate, which does match the ProMotion of the ‌MacBook Pro‌ for smooth scrolling, so there's no jarring transition. While the refresh rate is up to 120Hz, it tops out at 60Hz when using HiDPI and HDR at the same time due to bandwidth limitations. You can have 120Hz HiDPI, 120Hz HDR, or HiDPI HDR enabled, but not all three, and if that sounds confusing, it is. The limitation is because of the bandwidth needed for 4K, HDR, 120Hz, and Retina scaling all at once, and it's true for other 4K HDR 120Hz displays too. Mac settings and BenQ's software aren't intuitive when it comes to using the different modes. The app doesn't allow refresh rates to be manually adjusted, and it's not clear why HDR can't be activated when in HiDPI mode and at 120Hz. In the native display settings, HDR doesn't even show up as an option. I have to use the Mac settings to drop to 60Hz when using HiDPI, then the HDR option appears. I don't know that anyone is going to want to use 120Hz HDR without HiDPI in a scaled mode because it looks bad, so HDR mode effectively means running at 60Hz unless you're at the native 4K resolution. At 4K, you're not using HiDPI, so 120Hz HDR works fine. You can set up modes on the BenQ display to switch these parameters quickly when you want to watch HDR content. The MA320UG uses an IPS panel with what BenQ calls a "Nano Gloss" coating. It has 450 nits brightness, a 2000:1 contrast ratio, and DisplayHDR 400. It does not have the brightness level or the contrast ratio for the bright colors and deep blacks that make HDR content look incredible on a Retina display, but it's not terrible. Content that's bright makes the entire display brighter, drowning out dark colors and cutting some detail. This wouldn't be my first choice for HDR content, but it is an option. "Nano Gloss" is indeed glossy, and it looks fairly similar to the coating on my ‌MacBook Pro‌ and Studio Display. It's glossier than other 4K displays I've used, which are typically more matte. It has reflectivity that's similar to a ‌MacBook Pro‌'s display, so it's maybe not the best monitor if you have a bunch of bright lights behind you, or light from a bright window. BenQ says the MA320UG covers 98 percent of the P3 wide color gamut, with a color syncing feature that matches the color of the display to the Mac's display. I thought the colors were close to identical on the default setting when comparing the same image on the MacBook's screen and the BenQ display. I don't have a colorimeter, but to the naked eye it was close. There are options for tweaking red, blue, and green to get a better match if needed. The Mac color matching feature does not seem to work when the display is in HDR mode because HDR settings override it. The display supports setting different color profiles like P3, sRGB, Cinema, Game, or ePaper. Cinema cranks up contrast while lowering brightness, while Game increases brightness and sharpness. ePaper is a black and white mode, which is interesting if you want a quick access grayscale mode for reading. You can also set a custom user mode and adjust gamma, color temperature, contrast, sharpness, hue, and saturation. Display Pilot 2 is BenQ's display software that adds multiple "Mac" features to the MA320UG. I have mixed feelings about the software. It's useful and feature-rich, but wanted me to sign in with an Apple or Google account when I first installed it. My Apple Account passkey would not work, but I was able to use the software in guest mode. Signing in enables auto backup of personal settings to a Cloud server and allows display settings to sync across devices, but I'm not sure most people need that. It also opted me in to sharing analytics, diagnostics, and usage information with BenQ automatically (an opt out toggle is available in settings). You need the software to get the full feature set from the MA320UG, like the ‌MacBook Pro‌ color syncing. It also enables brightness control from your Mac's keyboard, which is done through macOS Accessibility permissions. Other display control apps like BetterDisplay do the same thing. In addition to color matching, True Tone, Night Shift, and automatic brightness sync are available too, so the BenQ display's white balance always mirrors your Mac's white balance. The display has a sensor that can be used to detect ambient light and keep brightness levels matched between the display and the connected Mac, but it made both displays inappropriately bright in my office. The ‌MacBook Pro‌'s ambient light sensor did a better job, and that's also an option for maintaining the same brightness levels. It is convenient to have a third-party display that behaves in the same way the ‌Studio Display‌ does, because you don't need to dig into menus for things like adjusting brightness. I think the app could use a better interface and improved instructions that outline what each feature does, but I appreciated the unseen features that made Mac settings work. The app has a long list of settings for customization and to meet different workload needs. It syncs color and Focus modes between the MA320UG and the Mac display. You can set display settings to go with a particular Focus mode. If you activate Do Not Disturb, for example, you can set a Low Blue Light mode on the MA320UG, change the color temperature, or choose a particular color mode. Focus options can be used for quickly changing display color modes by activating a Focus on the Mac. Using Focus modes requires enabling Full Disk Access, and that's not a setting that I enable for any app. There's a visual optimizer, blue light reduction feature, partition option for changing how tiled windows are displayed, quick access tools for swapping color modes and changing resolution, toggles for HiDPI and HDR, KVM settings, and a DualView mode where you can use one color profile on half the screen, and a different color profile on the other half. I don't know why, but there's also a Google bar that lets you enter a search term in the app that then opens a Google search on the web. With a 5ms response time, the MA320UG isn't ideal for competitive gaming, but it does support FreeSync for general gaming. There is a built-in KVM switch for using the same peripherals with two Macs or a Mac and a PC, and it can be used for cross-device copy paste and file transfers. Display Pilot 2 needs to be installed on both machines, with PBP mode activated and KVM set to auto switch. Display Pilot 2 understandably only works with BenQ displays, but that's frustrating if you want to use it with other third-party displays. I have a 4K OLED display for my PC that I sometimes use with my Mac, and if I want to adjust brightness or manage it, I have to use BetterDisplay. I can use BetterDisplay with the BenQ display too, but then I lose some of the features like color matching. Bottom Line BenQ's MA320UG is a good 4K display if you're looking for a Mac-friendly 32-inch display at a price that comes in under Apple's own display options. The Mac color matching and the software that allows it to work like a native display are useful, and a 120Hz refresh rate is appreciated when used alongside a ‌MacBook Pro‌. Many third-party displays are much less Mac-friendly and aren't able to function like a native display, but the MA320UG matches the Mac's color and white balance, which gives it an edge over competing 4K displays. For a 4K LCD display, the MA320UG has a good screen that pairs well with a Mac. It wouldn't be my first choice for HDR or gaming, but for everyday work, it's a solid option. A lot of displays are designed for Windows machines and don't have features that translate to a Mac, so I do appreciate that BenQ created the MA320UG with Mac functionality in mind. BenQ's software is decent, as long as you don't have another third-party display that you want to use along with the MA320UG. Multi-display management is a hassle when you have to use two different display software options. I wouldn't choose this over a ‌Studio Display‌ if I had the budget for Apple's monitor, but it is larger and hundreds of dollars less expensive. How to Buy The MA320UG is available from the BenQ website or from Amazon.com for $829.99. Note: BenQ provided MacRumors with an MA320UG for the purpose of this review. No other compensation was received.This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

macOS 27 Golden Gate Gains Native Ultrawide Display Support
Apple adds native ultrawide display support in macOS 27 Golden Gate, bringing higher resolutions and persistent display arrangements to users of widescreen monitors. The update allows ultrawide displays to run at resolutions up to 5K at 120Hz. Apple also says that display arrangements are now preserved across connections, so the layout automatically restores exactly as the user left it each time they plug in. The feature addresses a longstanding pain point for Mac users with ultrawide setups, who previously had to work around limited native resolution options or manually reconfigure their display arrangements after each connection. ‌macOS 27‌ Golden Gate is expected to ship to the public this fall. It is available to developers in beta now. Related Roundup: macOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Unifies iOS 27, macOS, and Even CarPlay Wallpapers for First Time
Apple has taken a new approach to its stock wallpapers with iOS 27 and macOS 27 Golden Gate, using variations of the same artwork across all platforms for the first time. In previous years, most platforms shipped with their own distinct wallpaper. This year, they all share a design called "Celosia," featuring sweeping, overlapping curves and soft shadows inspired by layered flower petals or folded paper. In Light mode, warm sandy gold blends into soft purple; Dark mode shifts to moody deep indigos with silvery-blue edges. The curved shapes also form a stylized "27," tying the design directly to the software version. The ‌iOS 27‌ and iPadOS 27 Celosia collection comes in three variants: a standard ‌iOS 27‌ version, Dynamic, and Color, each with separate Light and Dark versions optimized for the Home Screen and Lock Screen. ‌macOS 27‌ Golden Gate ships with dynamic wallpapers accessible only through the OS itself. Even CarPlay contains 14 Celosia wallpaper options in the first developer beta, spanning Light and Dark modes across Grey, Purple, Red, Teal, Blue, Brown, Dark Blue, and Green variants, plus a Hero option in both Light and Dark.Related Roundups: CarPlay, iOS 27, macOS 27Related Forum: HomePod, HomeKit, CarPlay, Home & Auto TechnologyThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

macOS 27 Lets You Resize iPhone Mirroring in New Aspect Ratios
macOS 27 Golden Gate brings a major improvement to iPhone Mirroring, allowing users to resize the window beyond the iPhone's fixed aspect ratio for the first time. Until now, iPhone Mirroring has been limited to the iPhone's native aspect ratio in a small window. Users could adjust the window's overall size somewhat, but its proportions remained locked. With ‌macOS 27‌, users can now change the aspect ratio of the iPhone Mirroring window itself, offering dramatically more flexibility for workflows that rely on the feature. The update was revealed in Apple's Platforms State of the Union address. Several fixed aspect ratios appear to be available rather than free-form resizing, meaning the system snaps to the nearest supported shape. Depending on the chosen aspect ratio, iPhone Mirroring renders either an adjusted version of the app's iPhone layout or its iPad layout, when one is available. Aspect ratio adjustments are currently limited to iOS 27-compatible apps, which at present means only native iOS apps. ‌macOS 27‌ also adds Control Center to iPhone Mirroring, joining the Home Screen, App Switcher, and Spotlight as iPhone areas accessible directly from the Mac. The improvements arrive alongside a broader push Apple made at this year's Platforms State of the Union, where developers were encouraged to move away from designing apps for fixed orientations and specific devices, and instead target what Apple described as "a dynamic range of sizes and aspect ratios." Apple introduced resizable iOS apps in iPhone Mirroring and on ‌iPad‌, with developers who rebuild against the latest SDK automatically opted in. A new resizable iOS simulator in Xcode lets developers test layouts across a wide range of screen sizes and aspect ratios. That guidance appears to have ramifications well beyond iPhone Mirroring, with wide speculation that the feature is essentially a veiled preparation for the upcoming foldable iPhone. Moreover, iOS 27 contains frameworks that point more explicitly toward foldable hardware: "foldState" and "angleDegrees." A third find, a new key that returns the total count of built-in displays on a device, suggests Apple is also preparing the software stack for a device with more than one integrated screen. Taken together, the strings and the resizability push appear to be laying the groundwork for the foldable iPhone, widely expected to be called the "iPhone Ultra" and anticipated to launch alongside the iPhone 18 Pro in September 2026.Related Roundup: macOS 27Tag: iPhone MirroringThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Introducing Microsoft Scout: Your always-on personal agent
Microsoft Scout is integrated across the Microsoft 365 apps you use every day, keeping it grounded in your flow of work. The post appeared first on Microsoft 365 Blog.

Read more »

Announcing the new Work IQ APIs
Work IQ is a new intelligence layer for Microsoft 365, designed to understand how work gets done across your organizations. The post appeared first on Microsoft 365 Blog.

Read more »

Introducing the 2026 Apple Design Award winners
Join us in celebrating these extraordinary apps and games.Meet the 2026 Apple Design Award winners

Read more »

Introducing Microsoft 365 Business with Copilot: The new standard for small business
On July 1, we're introducing new Microsoft 365 SKUs with Copilot built-in, designed to fit into the way small businesses already work. The post appeared first on Microsoft 365 Blog.

Read more »

Introducing a new design for Microsoft 365 Copilot
We’ve redesigned the Copilot app and how Copilot shows up across Microsoft 365 apps to better move with it: cleaner, faster, and in the flow of your work. The post appeared first on Microsoft 365 Blog.

Read more »

New and improved: Computer-using agents, a new workflows experience, and real-time voice experiences
Learn what’s new in Copilot Studio, May 2026: computer-using agents are now generally available, plus redesigned workflows and Work IQ extensibility. The post appeared first on Microsoft 365 Blog.

Read more »

New and improved: Agent governance, intelligent workflows, and connected app experiences
See what's new in Copilot Studio, April 2026: updates to workflows, increased control over agent operations, and an expanded agent usage estimator. The post appeared first on Microsoft 365 Blog.

Read more »

Microsoft 365 Copilot, human agency, and the opportunity for every organization
As AI and agents take on more of the execution, people have more agency than ever to unlock their ambition, direct what gets done, and own the outcomes. The post appeared first on Microsoft 365 Blog.

Read more »

Copilot Cowork: From conversation to action across skills, integrations, and devices
Today, we’re announcing additional capabilities in Cowork to expand on what it can make possible for you. The post appeared first on Microsoft 365 Blog.

Read more »

Microsoft Agent 365, now generally available, expands capabilities and integrations
Microsoft Agent 365 helps you take control of agent sprawl as your control plane to observe, govern, and secure agents and their interactions. The post appeared first on Microsoft 365 Blog.

Read more »

Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available
From first draft to final polish, Copilot acts as a true collaborator, taking action while you stay in control. The post appeared first on Microsoft 365 Blog.

Read more »

Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot
Microsoft 365 Copilot can now bring your go-to apps directly into the conversation, which closes the gap between AI-powered insight and real, in-app action. The post appeared first on Microsoft 365 Blog.

Read more »

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta's "AI support assistant" bot into resetting account passwords.

Read more »

Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a frequent staging ground for cyber mischief from Russia's intelligence agencies.

Read more »

Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Read more »

Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States.

Read more »

CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

Read more »

Patch Tuesday, May 2026 Edition
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers -- including Apple, Google, Microsoft, Mozilla and Oracle -- fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.

Read more »

Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.

Read more »

Vulnerability Summary for the Week of April 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info n/a-- OVMS3 3.3.005 Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. 2026-05-01 10 CVE-2026-37541 https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  tendacn[.]com-- W308R Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25316 ExploitDB-44373VulnCheck Advisory: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change  tendacn[.]com--W3002R Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers. 2026-04-29 9.8 CVE-2018-25317 ExploitDB-44380VulnCheck Advisory: Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change  tendacn[.]com--FH303/A300 Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25318 ExploitDB-44381VulnCheck Advisory: Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change  Weaver Network Co., Ltd.--E-office Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC). 2026-04-30 9.8 CVE-2022-50993 https://service.e-office.cn/knowledge/detail/5https://cn-sec.com/archives/1453025.htmlhttps://bbs.chaitin.cn/topic/37https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet  synway[.]net-- SMG Gateway Management Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC). 2026-04-30 9.8 CVE-2025-71284 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yamlhttps://mrxn.net/jswz/synway-9-2radius-rce.htmlhttps://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsAhttps://www.synway.net/https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address  Directorist Booking--Directorist Booking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2. 2026-04-27 9.3 CVE-2026-22336 https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve  Directorist--Directorist Social Login Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4. 2026-04-27 9.8 CVE-2026-22337 https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve  Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. 2026-04-27 9.8 CVE-2026-32644 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  n/a--Automotive Grade Linux (AGL) AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently. 2026-05-01 9.8 CVE-2026-37531 https://gerrit.automotivelinux.org/gerrit/src/app-framework-mainhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a-- cannelloni v2.0.0 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. 2026-05-01 9.8 CVE-2026-37539 https://github.com/mguentner/cannellonihttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  Carlson Software--VASCO-B GNSS Receiver The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials. 2026-04-28 9.4 CVE-2026-3893 https://www.carlsonsw.com/support-and-training/https://www.cve.org/CVERecord?id=CVE-2026-3893https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json  Mersenne--Prime95 Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands. 2026-04-29 8.4 CVE-2018-25299 ExploitDB-44649Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH  xataboost--XATABoost CMS XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information. 2026-04-29 8.2 CVE-2018-25300 ExploitDB-44622Official Product HomepageVulnCheck Advisory: XATABoost CMS 1.0.0 SQL Injection via news.php  Easy MPEG--Easy MPEG to DVD Burner Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe. 2026-04-29 8.4 CVE-2018-25301 ExploitDB-44565Product ReferenceVulnCheck Advisory: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow  Alloksoft--Allok Video to DVD Burner Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution. 2026-04-29 8.4 CVE-2018-25303 ExploitDB-44518Official Product HomepageVulnCheck Advisory: Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH  Filehippo--Free Download Manager Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code. 2026-04-29 8.4 CVE-2018-25304 ExploitDB-44499Product ReferenceVulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH  Sysgauge--SysGauge Pro SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges. 2026-04-29 8.4 CVE-2018-25307 ExploitDB-44455VulnCheck Advisory: SysGauge Pro 4.6.12 Local Buffer Overflow SEH  donmik--Buddypress Xprofile Custom Fields Type BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. 2026-04-29 8.8 CVE-2018-25308 ExploitDB-44432Official Product HomepageVulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution  Alloksoft--WMV to AVI MPEG DVD WMV Converter Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious input containing shellcode with structured exception handler (SEH) overwrite to bypass protections and execute code with application privileges. 2026-04-29 8.4 CVE-2018-25314 ExploitDB-44365Official Product HomepageProduct ReferenceVulnCheck Advisory: Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow  Alloksoft--Video Joiner Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with structured exception handler (SEH) overwrite and shellcode to achieve code execution when the application processes the license registration input. 2026-04-29 8.4 CVE-2018-25315 ExploitDB-44364Official Product HomepageProduct ReferenceVulnCheck Advisory: Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name  marketingfire--Widget Options Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0. 2026-05-02 8.8 CVE-2026-2052 https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cvehttps://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534https://plugins.trac.wordpress.org/changeset/3481338/https://plugins.trac.wordpress.org/changeset/3514411/  Milesight--MS-Cxx63-PD An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. 2026-04-27 8.8 CVE-2026-20766 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  wclovers--WCFM Frontend Manager for WooCommerce The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. 2026-05-02 8.1 CVE-2026-2554 https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cvehttps://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386https://plugins.trac.wordpress.org/changeset/3483695/  opencats--OpenCATS OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete. 2026-04-28 8.1 CVE-2026-27760 https://chocapikk.com/posts/2026/opencats-installer-rce/https://github.com/opencats/OpenCATS/pull/706https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint  Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. 2026-04-27 8.8 CVE-2026-27785 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware  Cockpit--Cockpit CMS Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server. 2026-04-29 8.8 CVE-2026-34965 https://github.com/agentejo/cockpithttps://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections  n/a--(UDS) & OBD-II (On Board Diagnostics for Vehicles) miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. 2026-05-01 8.8 CVE-2026-37536 https://github.com/miaofng/uds-chttps://github.com/openxc/uds-chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a--Open-SAE-J1939 (Daniel Martensson) collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt- >data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. 2026-05-01 8.1 CVE-2026-37537 https://github.com/DanielMartensson/Open-SAE-J1939https://github.com/collin80/Open-SAE-J1939https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  openampproject[.]org--OpenAMP v2025.10.0 OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. 2026-05-01 8.4 CVE-2026-37540 https://github.com/OpenAMP/open-amphttps://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a--MixPHP Framework 2.x Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to OpisClosureunserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution. 2026-05-01 8.4 CVE-2026-37552 https://github.com/mix-php/mixhttps://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phphttps://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975  benjaminprojas--WP Editor The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. 2026-05-01 8.8 CVE-2026-3772 https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cvehttps://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103https://plugins.trac.wordpress.org/changeset/3480577/  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0. 2026-04-30 8.1 CVE-2026-40600 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xmhttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  TRENDnet--TEW-821DAP A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer. 2026-05-02 8.8 CVE-2026-7607 VDB-360564 | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowVDB-360564 | CTI Indicators (IOB, IOC, IOA)Submit #806214 | Trendnet TEW-821DAP v1.12B01 CWE-120 Buffer Copy without Checking Size of Inputhttps://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_BO.md  carazo--Import and export users and customers The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page. 2026-05-02 8.8 CVE-2026-7641 https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cvehttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21https://plugins.trac.wordpress.org/changeset/3515646  Cozmoslabs--Profile Builder Pro The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory. 2026-05-02 8.1 CVE-2026-7647 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L13https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L13  Shenzhen Libituo Technology--LBT-T300-HW1 A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 8.8 CVE-2026-7674 VDB-360827 | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowVDB-360827 | CTI Indicators (IOB, IOC, IOA)Submit #800705 | Libtor Technology lbt-t300-hw1 closure, xreq). The NULL propagation chain through afb-context.c:110 (context- >credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context- >credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14. 2026-05-01 7.8 CVE-2026-37525 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) afb-daemon v19.90.0 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29. 2026-05-01 7.8 CVE-2026-37526 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) aglservice v17.1.12 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer. 2026-05-01 7.1 CVE-2026-37532 https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-levelhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643  n/a--Automotive Grade Linux (AGL) isotp-c openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information. 2026-05-01 7.1 CVE-2026-37535 https://github.com/openxc/isotp-chttps://github.com/openxc/isotp-c/blob/master/src/isotp/receive.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381  n/a-- Vanetza V2X v26.02 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver. 2026-05-01 7.5 CVE-2026-37554 https://github.com/riebl/vanetzahttps://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpphttps://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpphttps://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40595 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4060 https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1767https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1785https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/  chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40601 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-cpr6-mhgm-893whttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb- >prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings. 2026-05-02 7.5 CVE-2026-4061 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1748https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Hooks/SearchResults.php#L39https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Search.php#L152https://plugins.trac.wordpress.org/changeset/3503627/  cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context - `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4062 https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/  n/a--libssh2 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. 2026-05-01 7.3 CVE-2026-7598 VDB-360555 | libssh2 userauth.c userauth_password integer overflowVDB-360555 | CTI Indicators (IOB, IOC, IOA)Submit #805564 | libssh2 Shell interface, gaining root-level access to the device. 2026-04-29 4.3 CVE-2018-25310 ExploitDB-44387Vulnerability AdvisoryVulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution  gnu--wget2 wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. 2026-04-29 4.8 CVE-2026-1858 https://www.tenable.com/security/research/tra-2026-37  wazuh--wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4. 2026-04-29 4.4 CVE-2026-26204 https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857https://github.com/wazuh/wazuh/releases/tag/v4.14.4  Oracle Corporation--Oracle Linux An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context. 2026-05-01 4.4 CVE-2026-35233 Oracle Advisory  n/a-- V2Board  v1.7.4 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis. 2026-05-01 4.9 CVE-2026-37505 https://github.com/v2board/v2boardhttps://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9  nextlevelbuilder--ui-ux-pro-max-skill A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet. 2026-05-01 4.3 CVE-2026-7596 VDB-360549 | nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingVDB-360549 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805510 | nextlevelbuilder ui-ux-pro-max-skill 2.5.0 Slide Generator Multiple Stored XSShttps://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/  n/a--Open5GS A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component. 2026-05-02 4.3 CVE-2026-7601 VDB-360558 | Open5GS AMF gmm-handler.c denial of serviceVDB-360558 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805675 | Open5GS v.2.7.6 Denial of Servicehttps://github.com/open5gs/open5gs/issues/4321https://github.com/open5gs/open5gs/commit/ebc66942b6f8f1fab2d640e71cf4e9f1a423b426https://github.com/open5gs/open5gs/releases/tag/v2.7.7https://github.com/open5gs/open5gs/  itsourcecode--Courier Management System A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. 2026-05-02 4.7 CVE-2026-7612 VDB-360569 | itsourcecode Courier Management System edit_user.php sql injectionVDB-360569 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #806275 | itsourcecode Courier Management System V1.0 SQL Injectionhttps://github.com/ltranquility/submit/issues/12https://itsourcecode.com/  ChatGPTNextWeb--NextChat A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-02 4.3 CVE-2026-7643 VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyVDB-360755 | CTI Indicators (IOB, IOC, IOA)Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policyhttps://github.com/ChatGPTNextWeb/NextChat/issues/6756https://github.com/ChatGPTNextWeb/NextChat/  n/a--crmeb_java A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7673 VDB-360826 | crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadVDB-360826 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800684 | crmeb crmeb_java 1.3.4 Unrestricted Uploadhttps://fx4tqqfvdw4.feishu.cn/docx/EgMOdHyq6oyxhux5vpJcr5cgnAf?from=from_copylink  kerwincui--FastBee A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7676 VDB-360829 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalVDB-360829 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800723 | kerwincui FastBee ≤ 1.2.1 Path Traversalhttps://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink  jsbroks--COCO Annotator A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7680 VDB-360833 | jsbroks COCO Annotator Data Endpoint datasets.py path traversalVDB-360833 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #801150 | jsbroks COCO Annotator 0.11.1 Absolute Path Traversalhttps://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter  AMTT--Hotel Broadband Operation System A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7697 VDB-360866 | AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionVDB-360866 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #803272 | Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System v1.0 SQL Injectionhttps://github.com/testnet0/testnet/issues/74  Telegram--Desktop A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7701 VDB-360870 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceVDB-360870 | CTI Indicators (IOB, IOC, IOA)Submit #804341 | Telegram Telegram Desktop

Read more »

Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.

Read more »

Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction  Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access  Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH  Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH  Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH  faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field  Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter  Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service  Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002  Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service  Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field  Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow  Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName  icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection  Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command  Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field  infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import  faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow  Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service  Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields  Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG  ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion  Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog  Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service  Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input  Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service  Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service  Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory  Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow  Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field  P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field  Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow  94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields  Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service  Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server  Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow  Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field  P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service  Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001  OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763  HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605  IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907  hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php  Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209  Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html  Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet  Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/  Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki  EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95  Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf  Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server  ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes  PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0  Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech  Back to top

Read more »

‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.

Read more »

Most secure browser for Mac in 2026
For most Mac users, your browser is where a lot of online life happens — reading emails, logging into accounts, using web apps, shopping, and banking. It’s also where a small mistake can lead to a bigger problem, whether that means downloading something that looked harmless or signing into a phishing page that seemed real […] The post appeared first on The Mac Security Blog.

Read more »

Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.

Read more »

Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.

Read more »

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.

Read more »

Maintenance: Scheduled Infrastructure Maintenance
Status: ScheduledDuring this window, Zaps with polling-based triggers will pause briefly and resume automatically. Your Zaps stay “On”, and the next poll picks up any items missed. There is no action required on your end.  Questions? Contact Zapier Support: https://zapier.com/app/get-help.Affected components Polling Triggers (Under maintenance)

Read more »

Hyperdrive and KV API errors
Jun 9, 14:37 UTC Monitoring - A fix has been implemented and we are monitoring the results. Jun 9, 14:20 UTC Investigating - Cloudflare has identified an issue where some customers may experience latency or errors using Hyperdrive over Tunnels or the Workers KV API. We are working to analyze and mitigate this problem. More updates to follow shortly.

Read more »

Cloudflare Workers and Pages build delays
Jun 9, 10:37 UTC Investigating - Cloudflare is aware of and investigating an issue with which potentially impacts multiple customers. Further detail will be provided as more information becomes available.

Read more »

Network Performance Issues in Dubai
Jun 9, 07:30 UTC Resolved - Users in Dubai would have observed an increase in HTTP 5xx errors between 07:20 - 07:35 UTC 2026-06-09. This issue is now resolved.

Read more »

GraphQL elevated latency
Jun 9, 07:15 UTC Resolved - Cloudflare identified an issue where some customers may have experienced latency querying the GraphQL API between 07:15 and 09:30 UTC.This has been resolved.

Read more »

Network Performance Issues in Mexico
Jun 9, 01:30 UTC Resolved - Connectivity errors (HTTP 500s) and elevated latency observed due to a hardware failure between 01:32 - 01:36 UTC 2026-06-09. Cloudflare has mitigated the issue.

Read more »

Network Performance Issues in Mexico
Jun 9, 01:30 UTC Resolved - Connectivity errors (HTTP 500s) and elevated latency observed due to a hardware failure between 01:32 - 01:36 UTC 2026-06-09. Cloudflare has mitigated the issue.

Read more »

Increased HTTP 500 errors for R2
Jun 8, 23:43 UTC Investigating - Some Cloudflare R2 users may have seen increased errors when using R2

Read more »

REC (Recife) on 2026-06-09
THIS IS A SCHEDULED EVENT Jun 9, 15:45 - 17:00 UTC Jun 8, 22:16 UTC Scheduled - We will be performing scheduled maintenance in REC (Recife) datacenter on 2026-06-09 between 15:45 and 17:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Shared content downloads are degraded
Jun 8, 19:43 UTC Investigating - We are currently experiencing performance issues affecting shared content downloads on Dropbox. Some people may see significantly slower downloads than expected, including delays when downloading small assets. We are working to resolve the issue as quickly as possible. Thank you for your patience.

Read more »

Elevated 500 errors on CF1 SaaS Integrations API
Jun 8, 17:36 UTC Investigating - Cloudflare One's SaaS integrations page has reported elevated HTTP 500 errors on API requests impacting ability to create, view, and manage integrations.

Read more »

Chatbots dropping connections; possible “Forbidden” errors
Status: IdentifiedWe identified an issue that caused some Chatbots to fail or time out when customers initialized chats or interacted with embedded chatbots. Some users may have seen a "Forbidden" error. • The affected period was approximately 11:00 PM – 5:30 AM MST on June 8, 2026. • Zap Runs and tasks were not affected. • No data loss is expected. • The issue has since self-resolved. Chatbots metrics are healthy and error rates have returned to normal. We traced the cause to a degradation in our LLM proxy, which led to backend request timeouts and dropped chatbot connections. We are continuing to investigate the scope of customer impact and will post another update soon. If you experienced issues with Chatbots during this window or notice anything still not working, please contact Support: https://zapier.com/app/get-helpAffected components Chatbots (Degraded performance)

Read more »

RealtimeKit performance issues
Jun 8, 16:34 UTC Investigating - Some RealtimeKit users may not join meetings, team is investigating.

Read more »

Increased HTTP 500 errors for R2 in WEUR region
Jun 8, 16:00 UTC Resolved - Cloudflare R2 users may have seen increased errors when reading data from buckets stored in WEUR.

Read more »

NRT (Tokyo) on 2026-06-08
THIS IS A SCHEDULED EVENT Jun 8, 16:00 UTC  -  Jun 9, 02:00 UTC Jun 8, 15:28 UTC Scheduled - We will be performing scheduled maintenance in NRT (Tokyo) datacenter between 2026-06-08 16:00 and 2026-06-09 02:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Refurb 9th-Gen. Apple iPad 10.2″ 64GB WiFi Tablet (2021) for $166 + free shipping
This refurbished Apple iPad 9 (2021) at eBay is $42 less than you'd pay for a refurb from Best Buy. A one-year Allstate warranty is provided with purchase.   Buy Now at eBay

Read more »

Apple MacBook Air M4 13.6″ Laptop w/ 512GB SSD (2025) for $899 + free shipping
Today only, the 13″ MacBook Air M4 is $300 off its regular price at B&H. The configuration includes a 10-core CPU, 16GB of unified memory, and a 512GB SSD. Buy Now at B&H Photo Video Features 16GB RAM, 512GB SSD Apple M4 Chip 10-core processor 13.6″ 2560×1664 Liquid Retina display MacOS

Read more »

Refurb 5th-Gen. Apple iPad Air 10.9″ 64GB WiFi Tablet for $242 + free shipping
That's the best price we've seen on this iPad Air tablet in any condition. A one-year warranty through Allstate is included. Buy Now at eBay

Read more »

Apple Summer Rollbacks at Walmart: Up to 46% + free shipping
Walmart’s Apple Summer Rollbacks includes iPhones, iPads, MacBooks, and accessories, all shipping free and discounts by up to 46%. Highlights include the Apple Watch Series 11 at $299, down from $429, and AirPods Pro 3 at $199, down from $249. The 2025 iPad 11″ starts from $272, down from $349.  Shop Now at Walmart Features […]

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – FCR24LL/A – $1,609.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – FCR24LL/A $1,609.00 $1,899.00  −15% Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 512GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Yellow – G1K22LL/A – $2,459.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Yellow – G1K22LL/A $2,459.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 2TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU – Orange – FWUJ3LL/A – $1,099.00
Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU - Orange – FWUJ3LL/A $1,099.00 $1,299.00  −15% Originally released October 2024 24-inch 4.5K Retina display 16GB unified memory 256GB SSD 12MP Center Stage camera with support for Desk View Two Thunderbolt / USB 4 ports Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K36LL/A – $2,289.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K36LL/A $2,289.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 2TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Silver – G1K12LL/A – $2,459.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Silver – G1K12LL/A $2,459.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 2TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU – Purple – G1E75LL/A – $1,609.00
Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU - Purple – G1E75LL/A $1,609.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Two Thunderbolt / USB 4 ports Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Silver – G1EH2LL/A – $1,609.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Silver – G1EH2LL/A $1,609.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 256GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Silver – G1K18LL/A – $1,949.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Silver – G1K18LL/A $1,949.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1K10LL/A – $1,779.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1K10LL/A $1,779.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1K16LL/A – $2,289.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1K16LL/A $2,289.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 2TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Apple 13″ M5 MacBook Air (2026) for $950 + free shipping
The newest 13″ MacBook Air with a M5 chip is currently at a price low currently at Best Buy. Othger retailers charge $150 more. Buy Now at Best Buy Features 13.6″ 2560×1664 display Apple M5 CPU 16GB RAM + 512GB SSD Mac OS

Read more »