Apple releases iOS 26.6 beta 2 for iPhone, here’s what to expect [U]
June 16, 2026: A day later, iOS 26.6 public beta 2 is now available as well. While iOS 27 is the new focus for pre-release software, Apple is still preparing iOS 26.6 as the next iPhone update. Apple has released the second iOS 26.6 developer beta. The update follows the first developer beta release and public beta release in May.

Read more »

Adobe's glowing AI survey leaves out most of the creative industry
Adobe claims that 75% of creatives now say creative AI is essential to their work, which might be true if you're willing to severely restrict what your definition of a creator is.Adobe AI creator survey excludes traditional creativesOn Tuesday, Adobe released its 2026 Creators' Toolkit Report. According to Adobe, this report is:"[A] global study exploring how content creators are integrating creative generative AI and mobile tools in their workflows, and what they expect from the next generation of AI, including agentic AI." Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple plans one of its most ambitious product waves ever for 2027
Apple 2027 product releases ambitiously shape up to include camera AirPods, 2nd-gen foldable iPhone and 20th anniversary iPhone. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

'Widow's Bay' playlist lasts nearly 10 times longer than the show
Apple Music's new "Widow's Bay" playlist lasts so long that it can outlive the entire first season several times over.Patricia's Sunset CocktailsApple Music has published "Patricia's Sunset Cocktails Playlist", a collection inspired by the world of "Widow's Bay." While the playlist page doesn't prominently advertise its size, scrolling to the bottom reveals 811 songs with a total runtime of 60 hours and 32 minutes in the US version of Apple Music."Widow's Bay" follows a small coastal town whose residents become entangled in a series of strange events and long-buried secrets. Patricia's bar serves as one of the community's gathering places.The playlist pulls from a wide range of artists, including David Bowie, Donna Summer, Pat Benatar, Kylie Minogue, Kim Wilde, Pulp, Talk Talk, and Erasure. The mix spans decades of pop, rock, dance, and new wave music. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

These are the best iPadOS 27 features you should try [Video]
Last year, Apple blew me away with the new multitasking features in iPadOS 26. It felt like a true step forward, giving us a more Mac-like experience. This year, iPadOS 27 aimed to tighten everything up and give us the best version of iPadOS we have ever seen. The update might not have been as flashy as last year’s, but it has made my iPad smarter, faster, more capable, and the performance now feels drastically improved. There are 100s of new small tweaks and changes, but I wanted to share my five favorite features you need to try.

Read more »

Apple’s 2027 Megalaunch: Camera-equipped AI AirPods, next-gen foldable iPhone, and Twentieth Anniversary iPhone
Apple plans a major wave of releases in late 2027, headlined by long-rumored camera-equipped AI AirPods, a second-generation foldable… The post appeared first on MacDailyNews.

Read more »

Apple releasing 20th anniversary iPhone, AirPods with cameras next year: report
A new Bloomberg report today details three major new products from Apple coming in late 2027: the 20th anniversary iPhone, a second-generation foldable iPhone, and AirPods with built-in cameras.

Read more »

Apple Watch Ultra 3 gets a $100 price cut ahead of Prime Day
Macworld Apple Watch Ultra 3 View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Apple’s Watch Ultra 3 is down to $700, a $99 price cut on the most rugged, feature-packed watch the company makes. This isn’t the absolute best price we’ve seen for this model, which dipped a bit lower during Black Friday, but it’s still a great discount and the best we’ve seen all year. This watch was built to survive all your adventures. With a titanium case that will resist all sorts of knocks and a sapphire crystal display that’s scratch-resistant, this pricey wrist accessory won’t suffer any damage the first time your feet slide down the path, and you hug a tree. It will also be quite the companion when you’re swimming, as it comes with water resistance down to 100 meters, running, or anything else. This combo makes the smartwatch a great fit for anyone who isn’t exactly gentle with their gear. The Apple Watch Ultra 3 display is super bright, which means it’s easier to read in all situations, even at wide angles. This makes it easy to check your stats mid-run or in bright sunlight. It also doubles as a flashlight in a pinch. The Watch Ultra 3 comes with dual-frequency precision GPS that precisely tracks your route and pace, even in rough terrain. It will also track your fitness routines with ease. The battery will last for about 42 hours on normal use and up to 72 hours in Low Power Mode. The number will dip lower if you’re using the GPS workout tracking mode. The health features are amazing too, as the watch can take an ECG, read blood oxygen levels, track your sleep score, and even flag sleep apnea, hypertension, or irregular heart rhythms. The one issue we have with this watch is that it costs a lot of money. $799 for a smartwatch, even an Apple Watch Ultra, is a lot of cash. That’s why taking advantage of deals such as this one is important. At $99 off, the Apple Watch Ultra 3 is an easy pick if you genuinely live an active, outdoor life and want the best smartwatch for the job.

Read more »

LiberNovo Maxis: The ergonomic chair redesigned for the bodies that design everything else
Macworld LiberNovo Early Bird Pricing June 16-July 31: LiberNovo offers its lowest prices ever Up to 44% off (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); LiberNovo is simultaneously launching three new chairs: the Maxis, designed specifically for big and tall users; the Omni Pro, a high-end model featuring electric seat ventilation; and the Omni SE, an accessible entry-level option. From June 16 to July 31, all three are available at super early-bird pricing — discounts exceeding 44% off MSRP, the lowest pricing LiberNovo has ever offered. For anyone who has been waiting for the right moment to address the weakest link in their setup, that moment is now. Designed for professionals There’s an irony that runs quietly through the world of professional design. The people who obsess over proportions, negative space, and the precise relationship between form and function—the UX designers, the brand strategists, the motion graphics artists, the architects—often spend their working lives in chairs that were engineered with little thought for any of those principles. And for bigger, taller creative professionals, the situation is worse still: a market full of ergonomic chairs that promise the world and deliver a scaled-up standard model with a premium price tag. LiberNovo’s new Maxis Series exists to correct that oversight entirely. Part of a three-chair launch that also includes the high-end Omni Pro and accessible Omni SE, the Maxis is LiberNovo’s large-format flagship—a chair designed from the ground up for users between 5’10” and 6’7″, supporting frames up to 399 lbs. From June 16 to July 31, all three models are available at super early-bird pricing, with discounts exceeding 43% off MSRP. For designers and sedentary professionals who spend most of their working lives seated, this is a meaningful investment opportunity at the lowest price LiberNovo has ever offered. Pre-order Maxis series from $809 / £719 instead of $1,299 / £1,099. LiberNovo Why “Large-Size” has always been a lie Ask any tall or broad-framed professional about their chair history and you’ll hear a familiar story. The headrest never quite reaches. The seat cuts into the thighs halfway through the afternoon. The armrests force the elbows inward at an angle that gradually tightens the shoulders. The recline mechanism, which felt solid in the showroom, develops an unsettling instability under real-world weight. These aren’t minor inconveniences. For designers working ten-hour creative sprints in Figma or After Effects, or analysts and writers spending their careers in front of a screen, chronic discomfort is a productivity killer and a long-term health risk. Lower back tension, poor circulation, and postural fatigue don’t stay at the desk—they follow you home. The Maxis was built by a team that understood this intimately, and the engineering reflects it. LiberNovo Designed with intention The headrest alone tells you this chair was designed differently. Offering 140mm of vertical and 120mm of horizontal adjustment, with a U-shaped profile that tracks the natural curve of the cervical spine, it provides genuine support for longer necks and broader shoulders—not a gesture toward it. For designers who spend hours leaning toward a monitor in focused concentration, proper neck support isn’t a luxury; it’s essential to finishing the day without tension headaches. The backrest spans 430mm at the shoulder and 520mm at the waist, providing full coverage for larger builds rather than the partial contact that traditional chairs pass off as support. A flared lower section relieves hip pressure during extended sitting, while LiberNovo’s Bionic Flexfit BackRest—built from eight flexible panels with a multi-pivot linkage system—moves continuously with your body rather than holding it rigidly in place. The 52cm ultra-deep seat eliminates the leg-dangling problem that undermines circulation and accelerates fatigue across long working sessions. Custom arc armrests with an extended adjustment range keep broad frames comfortable without compressing the waist—a detail that makes an enormous difference for designers who naturally shift and reach across large creative workflows. And a six-spring Controlled Recline System engages progressively by angle and weight, delivering smooth, confident recline without the sudden drops that make larger users wary of reclining at all. Underpinning everything is LiberNovo’s platform-wide Dynamic Support System: 60 precision joints reacting in milliseconds, four synchronized mechanisms continuously adjusting to your movement, and an ErgoPulse electric lumbar motor maintaining your spine’s natural S-curve throughout the day. Given that research shows the human body makes over 127 unconscious postural adjustments across a standard working day, a chair that moves with you rather than against you isn’t a premium feature—it’s the baseline that ergonomic seating should have always achieved. LiberNovo An investment in your most important tool Designers understand better than most that the right tool changes the quality of the work. A poorly calibrated monitor, a trackpad that doesn’t respond with precision, a desk at the wrong height—each creates friction that compounds across thousands of hours. Your chair is no different, and for big and tall professionals who’ve spent years accommodating hardware that doesn’t truly fit, the Maxis represents something genuinely new. The super early-bird pricing window runs until July 31. For creative professionals and sedentary workers who are serious about long-term comfort, posture, and productivity, the timing is worth noting. Pre-order Maxis series from $809 / £719 instead of $1,299 / £1,099. LiberNovo Omni: Dynamic support for full-body alignment In addition to the Maxis, LiberNovo is expanding the series with two other variants. The Omni Pro is aimed at demanding people and comes with electric seat ventilation—useful for long working days in summer or warm offices. The Omni SE offers the ergonomic core functions with manual adjustment and is the more affordable entry-level variant. Super early-bird pricing LiberNovo Maxis plus Omni Pro, and Omni SE have super early-bird pricing is available from June 16 to July 31 at libernovo.com. U.S. early-bird pricing Omni Pro starts from $909, up to 35% off Omni SE starts from $569, up to 41% off Maxis Series starts from $809, up to 44% off U.K. early-bird pricing Omni Pro starts from £849, up to 41% off Omni SE starts from £509, up to 44% off Maxis Series starts from £719, up to 44% off Deliveries of the Omni Pro and Omni SE are already underway, with the Maxis to follow from August 10, 2026.

Read more »

No Liquid Glass slider for Apple Watch, but here’s how watchOS 27 design changes
With iOS 27, Apple is giving iPhone users a slider to customize how clear or frosted Liquid Glass appears. While the same slider comes to the Mac and iPad, Apple Watch just has one Liquid Glass setting for everyone. However, watchOS 27 does change the look of Liquid Glass on Apple Watch in subtle ways.

Read more »

No Liquid Glass slider for Apple Watch, but here’s how watchOS 27 design changes
With iOS 27, Apple is giving iPhone users a slider to customize how clear or frosted Liquid Glass appears. While the same slider comes to the Mac and iPad, Apple Watch just has one Liquid Glass setting for everyone. However, watchOS 27 does change the look of Liquid Glass on Apple Watch in subtle ways.

Read more »

Amazon slashes M5 MacBook Air with 24GB RAM, 1TB SSD to $1,329
Amazon has quietly issued steeper M5 MacBook Air price drops on high-end configurations with 24GB of RAM and 1TB of storage thanks to an early Prime Day coupon.Pick up Apple's upgraded M5 MacBook Air with an early Prime Day discount - Image credit: AppleAmazon's early Prime Day MacBook Air deals deliver $170 in stacked savings thanks to a $150 cash discount stacked with a $20 in-cart coupon for qualifying accounts (business accounts may see a single $170 discount in lieu of the $20 in-cart savings) on both 13-inch and 15-inch configurations.Buy 13-inch MacBook Air M5 (24GB RAM, 1TB SSD) in Sky Blue: $1,329 ($170 off)Buy 15" MacBook Air M5 (24GB RAM, 1TB SSD) in Midnight: $1,529 ($170 off) Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple TV announces fourth season for ‘The Reluctant Traveler With Eugene Levy’
Today, Apple TV announced a fourth season renewal for the Emmy Award-nominated travel series “The Reluctant Traveler With Eugene Levy”… The post appeared first on MacDailyNews.

Read more »

iPhone 17 won’t get iOS 27’s top-tier features, here’s why
iOS 27 has some exciting new Apple Intelligence upgrades coming, but you’ll need the most powerful iPhones to access some of them—and in a repeat of recent history, iPhone 17 won’t even make the cut. Here’s why.

Read more »

Deals: iPhone 17 Pro $290 off, Apple Watch Series 11 $130 off, nano-texture M5 Pro MacBook Pro $300 off, more
Amazon is delivering all MacBook Neo models well ahead of Father’s Day from $590, AirPods Pro 3 are still down at $179, and today’s 9to5Toys Lunch Break is headlined by iPhone 17 Pro at up to $290 off the list prices via Amazon renewed right now. You can also score Dad an Apple Watch this year starting down at $219 shipped, or Apple’s 2026 AirPods Max 2 down at Amazon all-time low pricing, but we also have a rare $300 price drop on this M5 Pro MacBook Pro with the nano-texture display today as well. Up to $190 off Beats headphones, the 240W Beats USB-C cable from $19, and more awaits below.

Read more »

PSA: It’s not just you, Spotify is currently down
If you’re having trouble accessing Spotify today, you’re not alone. The company has confirmed an ongoing outage affecting some users.

Read more »

You’ll never misplace this slim Moft iPhone wallet stand [Review] ★★★★☆
The Moft Trackable Snap-on Phone Stand & Wallet (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Today in Apple history: iPhone 4 preorders set an impressive record
On June 16, 2010, Apple reported a massive surge of interest in its upcoming iPhone 4, with 600,000 sales on the first day of preorders. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Here’s everything new for Apple Photos in iOS 27
iOS 27’s biggest highlight is Siri AI, but the update also packs new features for apps like Messages, Notes, Wallet, and more. Here’s everything new for Apple’s Photos app in iOS 27.

Read more »

Apple’s initial iOS 27 and macOS 27 betas are remarkable stable
Apple’s first developer betas are rarely known for their polish, but iOS 27 (and macOS 27) appear to be breaking that rule. In this personal… The post appeared first on MacDailyNews.

Read more »

Apple’s initial iOS 27 and macOS 27 betas are remarkably stable
Apple’s first developer betas are rarely known for their polish, but iOS 27 (and macOS 27) appear to be breaking that rule. In this personal… The post appeared first on MacDailyNews.

Read more »

Sharepower is a magnetic power bank that snaps in half so you can share a charge
Nimble, the maker of many interesting iPhone accessories, is launching a new product called Sharepower, which it bills as the world’s first sharable battery. Nimble says Sharepower will be available in Apple retail stores.

Read more »

Base model iPhone 18 very likely to support all Siri AI features
Only three existing iPhone models get access to all of the new on-device Siri AI features: the iPhone 17 Pro, Pro Max, and iPhone Air. While the base model iPhone 17 is excluded, it’s very likely that the non-Pro version of the iPhone 18 will get access to all of the new features …

Read more »

Apple TV is $5.99/month (50% off) for Prime members, details here
Apple TV just launched a new $5.99/month (50% off) promo deal that lets Amazon Prime members subscribe at a steep discount for up to two months. Here are the details.

Read more »

Elon Musk’s SpaceX plus Tesla set to eclipse Apple’s market cap
SpaceX stock is surging in early trading, pushing its market capitalization above $2.9 trillion and putting the rocket company neck-and-neck… The post appeared first on MacDailyNews.

Read more »

Grab this massive 24,000mAh Anker power bank for a dirt-cheap $35
Macworld Anker 65W 24,000mAh power bank View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Anker’s 24,000mAh 65W power bank is down to $35, a 50 percent discount from its $70 MSRP at Woot. For a power bank with such a high capacity, $45 is an absolute bargain price. The 24,000mAh capacity is what impresses us most about this power bank. That’s enough juice to fully top off a MacBook Pro about once, or refill an iPhone four times over and still have leftover battery for your AirPods. This is the type of power bank that will do a fantastic job when you’re away for a couple of days, even if you’re nowhere near a power outlet. The 65W total output is what makes this Anker model more than a smartphone charger. Along with its tremendous capacity, it also features two USB-C ports so you can fast-charge two power-hungry devices at once. The battery will work just fine with laptops, phones, tablets, and most USB-C gear, so you won’t need different gear. You do have to keep in mind that when multiple devices are charging, the 65W will be split between devices, so your laptop won’t get the same power. At $35, this Anker power bank is all you’ll ever need to get through a weekend outdoors or just a long day of working on the road.

Read more »

Take the pain out of transferring large files with this pro platform
Get lifetime access to file transfers with unlimited file sizes and pro tracking and delivery. Save on Transfr Pro file transfer service. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Father’s Day gift guide: The best Beats headphones, Apple Watch, more
Father’s Day is just around the corner, and we’ve got a whole bunch of tech-focused recommendations for gift ideas for the dad in your life. Whether you’re looking to take advantage of some killer deals on Apple’s versatile lineup of Beats headphones, add an Apple Watch to his arsenal, or upgrade his tech everyday carry, we have some ideas for you.

Read more »

Italy targets iCloud interoperability for DMA investigation
Apple's troubles with the EU's Digital Markets Act are continuing, with Italy now investigating iCloud and the cloud storage market.The EU's DMA is now being used against iCloudThe Digital Markets Act has been a thorn in Apple's side, with it giving regulators more reasons to examine its business practices in Europe. In the latest salvo, Italy's Competition Authority is now going after the company.In a statement released on Tuesday, the Autorita Garante Della Concorrenza E Del Mercato said it had launched an investigation into Apple Inc, Apple Distribution International Ltd, and Apple Italia. It is looking into whether Apple complies with the DMA's interoperability requirements, specifically for cloud storage. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Tailscale Aperture targets shadow AI with new controls for IT teams
Today, Tailscale has announced new capabilities for Aperture, its AI access and control platform, designed to provide IT teams with a common and stable layer for managing AI across evolving models, tools, and data sources.

Read more »

Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction  Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access  Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH  Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH  Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH  faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow  Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field  Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter  Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service  Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002  Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service  Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field  Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow  Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName  icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection  Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command  Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field  infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import  faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow  Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service  Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields  Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG  ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion  Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog  Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service  Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input  Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service  Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service  Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory  Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow  Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field  P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field  Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow  94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/  Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields  Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service  Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server  Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow  Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field  P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service  Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001  OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763  HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605  IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907  hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php  Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209  Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html  Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet  Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/  Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki  EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95  Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf  Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server  ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes  PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0  Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech  Back to top

Read more »

‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.

Read more »

Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.

Read more »

Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.

Read more »

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.

Read more »

‘CanisterWorm’ Springs Wiper Attack Targeting Iran
A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran's time zone or have Farsi set as the default language.

Read more »

Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets -- named Aisuru, Kimwolf, JackSkid and Mossad -- are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.

Read more »

Metro Makes Apple’s iPhone 16e Effectively Free — Plus a Free $100 Visa Card
Metro by T-Mobile is now offering one of the more aggressive prepaid iPhone deals currently available, giving switchers Apple’s iPhone 16e effectively for free when they bring over their existing number. Customers pay $99.99 upfront for the 128GB iPhone 16e, then receive a $100 virtual prepaid Mastercard after maintaining qualifying service for three months, offsetting the entire device cost. Metro is also including instant savings at checkout, making this one of the simpler no-trade-in iPhone offers currently available. See this deal on Metro's website. For additional iPhone sales and carrier promotions, visit our iPhone Price Tracker, updated regularly.

Read more »

Amazon Slashes 13″ & 15″ M5 MacBook Air Prices by $200 off Apple MSRP, prices now start at only $899
Amazon has increased its End of Memorial Day discounts on Apple's entry-level M5 MacBook Air lineup, dropping both the 13-inch and 15-inch 16GB/512GB models by $200 below Apple's MSRP. The 13-inch model is now available for about $899, while the larger 15-inch version has fallen to roughly $1099. Shop the 13-inch deal here. These are some of the lowest prices we've seen so far on Apple's newest MacBook Air models, making right now a particularly attractive time to buy. View the 15-inch deal here. For the latest sales and deals, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, updated daily.

Read more »

14″ M5 MacBook Pros on Sale at Amazon & B&H — Up to $200 Off Apple Pricing
Amazon and B&H are both offering discounts on Apple's popular 14-inch M5 MacBook Pro configurations, with the 16GB/1TB model now selling for $200 below MSRP and the 24GB/1TB version discounted by $150. Check current Amazon pricing here. While Amazon offers fast shipping and broad availability, B&H matches many of the same sale prices while adding free 1–2 day shipping to most U.S. addresses. Browse current B&H pricing here. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Memorial Day Sale: 13″ M5 MacBook Airs Return to $150
Amazon has brought back its $150-off pricing on Apple’s 13-inch M5 MacBook Air lineup for Memorial Day weekend, with discounts available across multiple configurations. The popular 16GB/512GB model is once again selling for about $949 instead of Apple’s $1099 MSRP, while higher-capacity models are seeing the same $150 discount. Check current Amazon pricing here. The nice thing about this sale is its consistency—every major 13-inch M5 MacBook Air configuration is discounted by the same amount, making it easy to compare models without worrying about uneven pricing. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

15″ M5 MacBook Airs on sale again for $150 at Amazon — Lowest Prices Yet
Amazon is now offering some of the best pricing yet on Apple’s 15-inch M5 MacBook Air lineup, with $150 discounts across all configurations. The popular 16GB/512GB model has dropped to about $1149 from Apple’s $1299 MSRP, and similar savings are showing up on higher storage and memory options as well. Check current deals at Amazon. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Discounts Space Black 14″ M5 MacBook Pros by Up to $300 Off MSRP
Amazon is now offering some of the best prices we’ve seen so far on Apple’s Space Black 14-inch M5 MacBook Pro lineup, with discounts ranging from $199 to $300 below Apple’s standard MSRP. The base 16GB RAM/1TB SSD model is now down to $1499.99 versus Apple’s $1699 MSRP, while the upgraded 32GB RAM/1TB SSD version has dropped to $1799 compared to Apple’s $2099 MSRP. Check current Amazon pricing here. The middle 24GB RAM/1TB SSD configuration is also discounted to $1749, or $150 below Apple pricing. Together, these are currently among the lowest prices available for Space Black 14″ M5 MacBook Pro models from Apple’s major retailers. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon Cuts Prices on 16″ M5 Pro/Max MacBook Pros — $250 Off MSRP
Amazon is now discounting Apple’s entire 16-inch M5 Pro and M5 Max MacBook Pro lineup by $250 off MSRP, with every listed configuration currently reduced below Apple’s standard pricing. The sale includes both Black and Silver models across the M5 Pro and M5 Max families, with prices starting at $2449.99 for the 24GB/1TB M5 Pro configuration. Check current Amazon pricing here. Higher-end M5 Max models are also seeing the same consistent $250 discounts, including the 36GB/2TB configuration at $3649.99 and the 48GB/2TB version at $4149.99. See these models here. These are currently the lowest prices available among Apple’s major retailers. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Verizon Drops AirPods Pro 3 to $199 — Lowest Price Available Anywhere Right Now
Verizon is currently offering Apple’s AirPods Pro 3 for $199, down from Apple’s standard $249 MSRP. That’s a clean $50 discount (20% off), and right now it appears to be the lowest widely available price from any major Apple retailer. Check current Verizon pricing here. The sale price applies to online orders only, and Verizon also offers free shipping or free local store pickup (if available in your area). Unlike many carrier promotions, Verizon service is not required to purchase the AirPods. For the latest sales and deals, see our AirPods Price Tracker, updated daily.

Read more »

Total Wireless Has One of the Most Aggressive iPhone 17e Deals Right Now
Total Wireless is currently offering one of the more aggressive iPhone 17e deals available right now. Customers signing up for the carrier’s $60/month Total 5G+ Unlimited plan can get the phone for $0 per month over 24 months, effectively covering the full cost of Apple’s $599 MSRP iPhone 17e. Check the current Total Wireless deal here. If you’d rather buy the phone outright, Total is also offering $200 off the full retail price, dropping the iPhone 17e to about $399 with qualifying plans and port-in activation. That combination of upfront savings and financing flexibility makes this one of the stronger prepaid iPhone deals available right now. For the latest sales and deals, see our iPhone Price Tracker, updated daily.

Read more »

MacBook Neo Still In Stock at Walmart While Apple Slips to 2–3 Week Delays
The MacBook Neo continues to stay in stock across Walmart’s online store, even as availability tightens at many other retailers and Apple’s own delivery estimates have slipped to roughly 2–3 weeks for many configurations. Check current MacBook Neo availability at Walmart. What makes Walmart stand out right now is the combination of immediate availability, fast free shipping, and free local store pickup options (where available). For buyers who don’t want to wait weeks for Apple delivery windows, Walmart has quietly become one of the easiest places to actually get a MacBook Neo quickly. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.

Read more »

Upgraded 32GB/1TB 14″ M5 MacBook Pros Drop Up to $300 Off at Amazon & B&H
Amazon and B&H are now offering major discounts on Apple’s upgraded 32GB/1TB 14-inch M5 MacBook Pro configurations, with the Silver model down to $1799 and the Space Black version at $1849, compared to Apple’s standard $2099 MSRP. That works out to savings of $250-$300 off, making these some of the strongest discounts we’ve seen so far on upgraded M5 MacBook Pro models. Check the deals at Amazon and B&H. B&H is also continuing to offer free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

New 32GB/1TB M5 14″ MacBook Pro Drops to $1849 at Amazon, $250 off!
Amazon is now offering Apple’s new 32GB/1TB M5 14-inch MacBook Pro for $1849, down from Apple’s standard $1999 MSRP. That’s a clean $250 discount on one of the more desirable upgraded configurations in the lineup. Check current pricing at Amazon here. Deals on upgraded MacBook Pro configurations tend to arrive more slowly than base models, which makes this one stand out a bit more than the typical entry-level sale. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »