India antitrust watchdog grows impatient over Apple’s efforts to delay investigation
The Competition Commission of India (CCI) has reportedly given Apple a final warning after more than a year of delayed responses in an ongoing antitrust investigation. Here are the details. more…

Read more »

LA Dodgers MVP Shohei Ohtani stars in new Beats campaign
New campaign gives Shohei Ohtani’s larger-than-life status a whole new meaning. Here are the details. more…

Read more »

Apple TV lands thriller series starring Dakota Fanning
Untitled Apple TV project will also see Dakota Fanning (All Her Fault) serve as executive producer alongside her sister, Elle Fanning (A Rainy Day in New York). Here’s what it’s about. more…

Read more »

9to5Mac Daily: January 15, 2026 – Apple Card drama, Apple’s AI servers 
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Stuff: Stuff helps you get everything out of your head and into a simple, elegant system—closing open loops and reducing mental stress. Use code 9TO5 at checkout for 50% off your first year. more…

Read more »

This new $90 SmallRig S70 mic kit launched at CES 2026 is a must-see for creators
SmallRig isn’t a new name for creators; we’ve featured a few of their products across the 9to5 network. But at CES 2026, SmallRig has released something that, in my opinion, will elevate them even further in the creator space. Let’s take a look at the SmallRig S70 mic kit. more…

Read more »

Korea rejects Elon Musk’s request for documents in lawsuit against Apple
The South Korean government has officially denied Elon Musk’s request for documents from the Kakao super app in xAI’s lawsuit against Apple. Here are the details. more…

Read more »

Apple TV lands new thriller starring Dakota Fanning
On Thursday, Apple TV announced it has landed a new original series created by Emmy Award winner Alex Cary with Dakota Fanning set to star… The post appeared first on MacDailyNews.

Read more »

iOS 26.3 release date: Here’s when the next iPhone update will arrive
Apple might release iOS 26.2.1 any day now with bug fixes, but the next iPhone update packing new features will be iOS 26.3. Here’s the expected iOS 26.3 release date. more…

Read more »

Here are Apple’s updated trade-in values for January 2026
Just two months after updating the trade-in values for iPhones, iPads, Macs, and Apple Watches, Apple has once again adjusted its maximum payout table for most products, with a few welcome surprises. Here are the details. more…

Read more »

6 secret features in Apple Mail to help you achieve Inbox Zero
Some people maintain zero unread emails thanks to masterful inbox management. These six Apple Mail app tips will help you manage your email. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Apple’s ‘Siri 2.0’ is almost here, but it’s only the start of AI overhaul
Apple Intelligence first launched in 2024, but it’s increasingly looking like 2026 will be a far more important year for the AI platform. And it all starts with ‘Siri 2.0’ coming this spring. more…

Read more »

Gemini Siri deal official, Apple Creator Studio, Vision Pro basketball 
Benjamin and Chance discuss the implications for Siri and the wider Apple ecosystem now that the Gemini deal is officially signed, and guess when we’ll start seeing the first new features ship. Also, they weigh up the appeal of the new Apple Creator Studio bundle, and Chance got to watch basketball courtside through his Vision Pro. And in Happy Hour Plus, the duo discuss the dependability of iCloud as a backup of your data, and what other backup strategies they recommend to use. Join now and save 26% on annual plans with code HAPPY26. Sponsored by Copilot Money: The personal finance app to make your money yours. Until January 20, get 26% off your first year at try.copilot.money/9to5mac. Sponsored by Stamps.com: Send from your computer or phone 24/7. Try Stamps.com risk-free for sixty days with code happyhour. Sponsored by 1Password: Take the first step to better security by securing your team’s credentials. Find out more at 1password.com/happyhour and start securing every login. more…

Read more »

Meta reverses WhatsApp’s third-party chatbot ban in Italy and Brazil
Following regulatory scrutiny, Meta has confirmed that the third-party LLM ban on WhatsApp won’t apply to users in Italy and Brazil. Here are the details. more…

Read more »

Air France announces new partnership with Apple TV to enhance its in-flight entertainment offer
As of January, Air France is teaming up with award-winning streaming service Apple TV to enhance its in-flight entertainment offer… The post appeared first on MacDailyNews.

Read more »

This strange Google Fast Pair flaw even puts iPhones at risk
Macworld If you use a Bluetooth device that supports Google Fast Pair, there’s a decent chance that it can be taken over by a hacker, who could then play audio, record through the device’s microphone, or even track you if the device supports Google Find Hub as well. And you’re not safe just because you use an iPhone or Mac—the vulnerability is in the device itself, and the hacker implements it from their own device within Bluetooth range. The vulnerability, called WhisperPair, exploits a flaw in the way many bluetooth devices implement Google Fast Pair technology. Here’s how it works: When a host device (like your phone or laptop) tries to pair with an accessory using Google Fast Pair (such as a pair of headphones), it tries to communicate with the accessory it wants to pair. If the device is not in pairing mode, Fast Pair is supposed to ignore any further action or requests. But according to researchers at the COSIC group of KU Leuven, some devices don’t implement this protocol properly, allowing the host to pair with the accessory anyway. If you use Apple accessories like AirPods or AirTags, you’re in the clear. These don’t support Google Fast Pair. But if you use popular Bluetooth accessories from other brands, such as Google Pixel Buds or Sony WH-1000 headphones, they have been tested to be vulnerable. And because this vulnerability exists in the accessories themselves, it doesn’t matter whether you use an iPhone or Android, Mac or PC. You can search a list of known vulnerable and known safe products on the WhisperPair site. Of note, the only Beats product that has been tested is the Solo Buds, and it’s been cleared from vulnerability. Several other models are listed on the site but haven’t been properly tested. If you have a vulnerable device, a fix will have to come in the form of a firmware update for that device. You’ll have to check in the future if the manufacturer of your bluetooth accessory has issued a firmware update and apply it. This could take some time, and for many accessories it may never arrive.

Read more »

Rumor Replay: iPhone 18 display leaks, Siri’s Gemini tidbits, more
This is Rumor Replay, a weekly column at 9to5Mac offering a quick rundown of the most recent Apple product rumors, with analysis and commentary. Today: iPhone 18 display leaks, Siri’s Gemini tidbits, and iPhone Air 2 upgrades. Here are this week’s Apple rumors. more…

Read more »

Steve Jobs would approve of building Google’s AI into Siri
If Steve Jobs were here, he'd definitely sign off on the Apple/Google partnership to add Gemini to Siri. Here's why. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

There's a new Apple monitor imminent, but what it will be is anybody's guess
An unannounced Apple display has appeared in a Chinese regulatory database, offering the clearest sign yet that Apple is preparing to refresh one of its long-stagnant external monitors very soon.Apple's Studio DisplayThe filing reveals a new model number and describes a high-performance LCD display, suggesting Apple may be updating the Studio Display, Pro Display XDR, or repositioning both. Though details are sparse, the timing and language imply the product is near release.The database listing is an Apple display with model number A3350, which matches no current product. Apple typically files regulatory paperwork late in development, generally months but sometimes weeks before announcements. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Spotify Premium jumps to $12.99/mo, $2 more expensive than Apple Music
Spotify subscribers — prepare for a price hike, as the company has announced another increase for users in the U.S., Estonia, and Latvia driving the cost notably above Apple Music.Image credit: Spotify"Thank you for being a valued Premium subscriber," the announcement starts. "Starting on your billing date in February, your subscription price will change from $11.99/month to $12.99/month."The company claims the price hike is being done to "keep delivering a great experience." Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Are people avoiding iOS 26 because of Liquid Glass? It’s complicated.
Liquid Glass is controversial, but adoption rates aren't as low as they seem.

Read more »

Verizon offers $20 account credit to subscribers affected by mass outage
Verizon has announced a $20 account credit for affected users as a token of apology. The telecommunications giant acknowledged falling short… The post appeared first on MacDailyNews.

Read more »

Spotify again jacks up subscription prices in the U.S.
Spotify has just announced price hikes in the U.S., Estonia, and Latvia — the company's third U.S. increase in under three years… The post appeared first on MacDailyNews.

Read more »

New Apple external display appears in regulatory filing
A new Apple monitor has reportedly appeared in a Chinese regulatory database. This comes as rumors suggest Apple will update at least one of its external displays, either the Studio Display or Pro Display XDR, at some point in 2026. more…

Read more »

Apple chipmaker TSMC is spending big on next-gen silicon, AI chips, and the U.S.
Main Apple chip partner TSMC had a great earnings report, and to keep up with demand, it is increasing its manufacturing spend by almost 40%. It's not clear how much this will benefit Apple.TSMC's headquarters in Hsinchu, TaiwanThe news comes after TMSC announced bumper quarterly results, which saw its profits increase by 35%. The company's strong performance is mostly thanks to the current AI boom, which has seen other chipmakers reap similar benefits.Both TSMC in an earnings report transcript and The Economic Times report that TSMC expects record revenue, thanks, in part, to its place at the forefront of chip technologies. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple forced to ‘fight’ for chip capacity, pay higher TSMC prices: report
Apple’s once dominant position as a TSMC customer is facing fresh challenges as the AI boom raises GPU demand from companies like NVIDIA and AMD, according to a new report. more…

Read more »

This case makes your iPhone feel caseless [Hands-on]
Over the years, I have tried 100s of iPhone cases, from rugged cases to leather cases, clear cases, and multifunctional wallet cases. And while these cases have their time and place, I always come back to the same type of case as my favorite: thin iPhone cases. There is just something about keeping the iPhone feeling like an iPhone that makes it enjoyable to use long-term. So when I saw Moft was releasing their new Movas Frame case, I had to give it a try. It was designed to be slim, light, and minimal while still adding protection. I’ve been using it for a few weeks, and here is what you should know. more…

Read more »

Disney Plus & Hulu bundle drops to $9.99 for a month, best streaming deal of 2026
Disney is running a limited-time promotion offering one month of the Disney Plus and Hulu bundle for $9.99, a 26% drop from the standard pricing.Stream original programming with this Disney Plus and Hulu deals - Image credit: Disney, HuluThe $9.99 promotion is available to new and eligible returning subscribers, which Disney defines as users not currently subscribed to Disney Plus or any Disney bundle. The promotion applies exclusively to the ad-supported bundle tier, and auto-renews at $12.99/mo or the then-current regular monthly price unless canceled.Get 1 month of Disney+ and Hulu for $9.99 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Deals: Apple Watch Ultra 3, M5 iPad Pro $200 off, Nomad leather iPhone 17 Pro/Max cases, chargers, more
Today’s 9to5Toys Lunch Break is now ready for you below starting off with the return of $200 price drops on the 13-inch M5 iPad Pro and a chance to land the black Apple Watch Ultra 3 at up to $117 off the list price. Those offers join ongoing Ultra 2 deals at up to $369 off as well as some accessory offers – USB-C Magic Mouse at more than 25% off, Nomad leather iPhone 17 Pro/Max cases at 20% off with a FREE screen protector, and Anker’s white model 25W Qi2 MagSafe Charging station with the onboard display at 30% off. All of the details and everything else awaits below.  more…

Read more »

Verizon offers $20 account credit following daylong cellular outage
Verizon is preparing to offer an olive branch to its customers after an outage took its cellular service offline for nearly ten hours. Here's how to get it.Verizon to issue $20 account credit after 10-hour outageOn Wednesday, around 12:30 PM ET, Verizon faced an outage that impacted hundreds of thousands of customers. Customers reported no service, with iPhone owners reporting an "SOS" where their network icon should have been.While users could still make calls and send texts via Wi-Fi, those away from an access point were left without service for up to ten hours. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Subway Surfers City is coming to iOS next month, details here
Subway Surfers has been one of the most successful mobile games ever. And now its long-anticipated sequel—Subway Surfers City—is officially coming next month. more…

Read more »

Patch Tuesday, January 2026 Edition
Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft's most-dire "critical" rating, and the company warns that attackers are already exploiting one of the bugs fixed today.

Read more »

Who Benefited from the Aisuru and Kimwolf Botnets?
Our first story of 2026 revealed how a destructive new botnet called Kimwolf rapidly grew to infect more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, we'll dig through digital clues left behind by the hackers, network operators, and cybercrime services that appear to have benefitted from Kimwolf's spread.

Read more »

The Kimwolf Botnet is Stalking Your Local Network
The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it's time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the internal network behind your Internet router probably is now dangerously out of date.

Read more »

Happy 16th Birthday, KrebsOnSecurity.com!
KrebsOnSecurity.com celebrates its 16th anniversary today! A huge "thank you" to all of our readers -- newcomers, long-timers and drive-by critics alike. Your engagement this past year here has been tremendous and truly a salve on a handful of dark days. Happily, comeuppance was a strong theme running through our coverage in 2025, with a primary focus on entities that enabled complex and globally-dispersed cybercrime services.

Read more »

Dismantling Defenses: Trump 2.0 Cyber Year in Review
The Trump administration has pursued a staggering range of policy pivots this past year that threaten to weaken the nation’s ability and willingness to address a broad spectrum of technology challenges, from cybersecurity and privacy to countering disinformation, fraud and corruption. These shifts, along with the president’s efforts to restrict free speech and freedom of the press, have come at such a rapid clip that many readers probably aren’t even aware of them all.

Read more »

Most Parked Domains Now Serving Malicious Content
Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the vast majority of "parked" domains -- mostly expired or dormant domain names, or common misspellings of popular websites -- are now configured to redirect visitors to sites that foist scams and malware.

Read more »

Computer Virus Protection Tips and How to Remove a Virus from Your Computer
Computer viruses continue to be a widespread and costly problem, affecting everyone from casual computer users to major organizations. Some of the most damaging incidents in history started with small actions that could have happened to anyone. The Melissa virus spread in 1999 because thousands of people opened what looked like a normal email attachment. […] The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, December 2025 Edition
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Read more »

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill
A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia's war against Ukraine.

Read more »

SMS Phishers Pivot to Points, Taxes, Fake Retailers
China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

Read more »

Vulnerability Summary for the Week of November 24, 2025
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info 0x4m4--HexStrike AI By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server's normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025). 2025-11-30 9.1 CVE-2025-35028 https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011  AMD--AMD Prof Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. 2025-11-24 7.1 CVE-2025-48510 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. 2025-11-24 8 CVE-2025-52538 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability 2025-11-24 7.3 CVE-2025-0003 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service. 2025-11-24 7.3 CVE-2025-0005 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability. 2025-11-24 7.3 CVE-2025-52539 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  ASR--Lapwing_Linux Out-of-bounds Read vulnerability in ASR1903ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26. 2025-11-26 7.4 CVE-2025-13735 https://www.asrmicro.com/en/goods/psirt?cid=41  blubrry--PowerPress Podcasting plugin by Blubrry The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2025-11-27 8.8 CVE-2025-13536 https://www.wordfence.com/threat-intel/vulnerabilities/id/d420ee49-e7b3-43d8-a263-8a93abd1133c?source=cvehttps://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3068https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3012https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L2368https://plugins.trac.wordpress.org/changeset/3402635/  Chanjet--CRM A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2025-11-30 7.3 CVE-2025-13788 VDB-333792 | Chanjet CRM upgradeattribute.php sql injectionVDB-333792 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #690084 | Chanjet CRM V1.0 SQL Injectionhttps://github.com/Bellingham-max/CVE/issues/1  code-projects--COVID Tracking System A vulnerability was detected in code-projects COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument code results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. 2025-11-24 7.3 CVE-2025-13585 VDB-333349 | code-projects COVID Tracking System login.php sql injectionVDB-333349 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699840 | code-projects COVID Tracking System V1.0 SQL Injectionhttps://github.com/beamyou/CVE/issues/4https://code-projects.org/  code-projects--Jonnys Liquor A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. 2025-11-24 7.3 CVE-2025-13582 VDB-333346 | code-projects Jonnys Liquor GET Parameter detail.php sql injectionVDB-333346 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699554 | code-projects Jonnys Liquor 1.0 /detail.php SQL injectionhttps://github.com/rassec2/dbcve/issues/5https://code-projects.org/  code-projects--Library System A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2025-11-24 7.3 CVE-2025-13578 VDB-333342 | code-projects Library System Login index.php sql injectionVDB-333342 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699536 | code-projects Library System 1.0 index.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/4https://code-projects.org/  code-projects--Question Paper Generator A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. 2025-11-24 7.3 CVE-2025-13583 VDB-333347 | code-projects Question Paper Generator POST Parameter signupscript.php sql injectionVDB-333347 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699591 | code-projects question paper 1.0 /signupscript.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/6https://code-projects.org/  cursor--cursor Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution. 2025-11-26 9.8 CVE-2025-62354 https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/  Dassault Systmes--DELMIA Service Process Engineer A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10555 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10555  Dassault Systmes--ENOVIA Product Manager A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10554 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10554  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. 2025-11-27 9.8 CVE-2025-13675 https://www.wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user- >set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. 2025-11-27 8.8 CVE-2025-13680 https://www.wordfence.com/threat-intel/vulnerabilities/id/645f60ad-c8e5-47ec-94f1-960de4ef7838?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  Eaton--Eaton Galileo Software Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. 2025-11-27 7.3 CVE-2025-59890 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1024.pdf  Elated Themes--FindAll Listing The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin. 2025-11-27 9.8 CVE-2025-13538 https://www.wordfence.com/threat-intel/vulnerabilities/id/14981949-271c-4f98-a6a1-b00619f1436d?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  Elated Themes--FindAll Membership The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email. 2025-11-27 9.8 CVE-2025-13539 https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  factionsecurity--faction FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction's extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1. 2025-11-26 9.7 CVE-2025-66022 https://github.com/factionsecurity/faction/security/advisories/GHSA-xr72-2g43-586whttps://github.com/factionsecurity/faction/commit/c6389f1c76175b7c1c68d1a87b389311b16c62c3  fugue-project--fugue Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server. The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. This issue has been patched via commit 6f25326. 2025-11-25 8.8 CVE-2025-62703 https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0  geoserver--geoserver GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0. 2025-11-25 8.2 CVE-2025-58360 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525https://osgeo-org.atlassian.net/browse/GEOS-11682  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads. 2025-11-26 7.5 CVE-2025-12571 GitLab Issue #579168HackerOne Bug Bounty Report #3362239  GL-Inet--GL-AXT1800 A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. 2025-11-24 8.3 CVE-2025-44018 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230  HCL Software--iNotes HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. 2025-11-25 8.1 CVE-2025-0248 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032  Huawei--HarmonyOS Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. 2025-11-28 9.3 CVE-2025-64314 https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8.4 CVE-2025-58302 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 8.4 CVE-2025-58303 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8 CVE-2025-58310 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. 2025-11-28 7.3 CVE-2025-58308 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 7.3 CVE-2025-58316 https://consumer.huawei.com/en/support/bulletin/2025/11/  Janitza--UMG 96-PA An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. 2025-11-24 7.5 CVE-2025-41729 https://certvde.com/de/advisories/VDE-2025-094  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0. 2025-11-29 7.1 CVE-2025-53896 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-23h2-3jj8-58hm  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0. 2025-11-29 7.2 CVE-2025-53899 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5  Logpoint--SIEM An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability. 2025-11-27 8.5 CVE-2025-66359 https://servicedesk.logpoint.com/hc/en-us/articles/29158899698333-XSS-Vulnerability-due-to-insufficient-input-validation  Mattermost--Mattermost Mattermost versions 10.12.x

Read more »

Take $400 off Apple’s 16-inch M4 Max MacBook Pros with Amazon’s latest sale prices
Amazon has 16-inch M4 Max MacBook Pros (Silver and Black colors) on sale for up to $400 off Apple's MSRP as part of their latest sales. Shipping is free. Be sure to select Amazon as the seller, rather than a third-party seller: - 16" M4 Max MacBook Pro (36GB/1TB/Black): $3299, $200 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Silver): $3349, $150 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599.05, $400 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Silver): $3834.99, $150 off MSRP These are the lowest sale prices currently available on new 16" M4 Max Apple MacBook Pros. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

14-inch M4 Pro MacBook Pros on sale for $250-$300 off Apple’s MSRP
B&H Photo is offering Black 14-inch MacBook Pros with M4 Pro CPUs for up to $300 off Apple's MSRP right now. B&H offers free 1-2 day shipping to most US addresses: - 14" M4 Pro MacBook Pro (24GB/512GB/Black): $1749, $250 off MSRP - 14" M4 Pro MacBook Pro (24GB/1TB/Black): $2099, $300 off MSRP Their prices are the lowest available today for new 14" M4 Pro MacBook Pros among the Apple retailers we track. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

M4-powered Mac minis return to low starting price of only $499
Amazon has M4 and M4 Pro Mac minis on sale starting at only $499 and ranging up to $130 off MSRP. Shipping is free: - Mac mini M4 (16GB/256GB): $499.99, $100 off MSRP - Mac mini M4 (16GB/512GB): $689.99, $110 off MSRP - Mac mini M4 (24GB/512GB): $889.99, $110 off MSRP - Mac mini M4 Pro (24GB/512GB): $1269.99, $130 off MSRP These are the lowest sale prices currently available for Mac minis. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

13-inch M3 iPad Airs on sale for $70-$110 off Apple’s MSRP
Take $70-$110 off 13-inch M3 WiFi iPad Airs at Amazon as part of their current sales. Shipping is free: - 13" 128GB WiFi M3 iPad Air: $689, $110 off MSRP - 13" 256GB WiFi M3 iPad Air: $789, $110 off MSRP - 13" 512GB WiFi M3 iPad Air: $999, $100 off MSRP - 13" 1TB WiFi M3 iPad Air: $1229, $70 off MSRP Be sure to order from Amazon itself rather than a third-party seller. These are the lowest prices currently available for new 13" M3-powered iPad Airs. For the latest prices & sales, keep an eye on our iPad Air Price Tracker, updated daily.

Read more »

11-inch M3 iPad Airs on sale for $100-$110 off Apple’s MSRP
Take $100-$110 off 11-inch M3 iPad Airs at Amazon as part of their current sales. Shipping is free: - 11" 128GB WiFi M3 iPad Air: $499, $100 off MSRP - 11" 256GB WiFi M3 iPad Air: $599, $100 off MSRP - 11" 512GB WiFi M3 iPad Air: $789, $110 off MSRP - 11" 1TB WiFi M3 iPad Air: $989, $119 off MSRP Be sure to order from Amazon itself rather than a third-party seller. These are the lowest prices currently available for new 11" M3-powered iPad Airs. For the latest prices & sales, keep an eye on our iPad Air Price Tracker, updated daily.

Read more »

13-inch M5 iPad Pros on sale for up to $200 off Apple’s MSRP
Amazon has Apple's 13-inch M5 WiFi iPad Pros on stock today and on sale for $100-$200 off MSRP. Shipping is free. These are the lowest 13" iPad Pro prices currently available: - 13" 256GB M5 iPad Pro: $1149 $150 off MSRP - 13" 512GB M5 iPad Pro: $1399 $100 off MSRP - 13" 1TB M5 iPad Pro: $1799 $100 off MSRP - 13" 2TB M5 iPad Pro: $2099 $200 off MSRP For the latest prices and sales, see our iPad Pro Price Tracker, updated daily.

Read more »

11-inch M5 iPad Pros on sale for $50-$148 off Apple’s MSRP
Amazon has Apple's 11-inch M5 WiFi iPad Pros on stock today and on sale for $50-$148 off MSRP. Shipping is free. These are the lowest 11" iPad Pro prices currently available: - 11" 256GB M5 iPad Pro: $949 $50 off MSRP - 11" 512GB M5 iPad Pro: $1099 $100 off MSRP - 11" 1TB M5 iPad Pro: $1499 $100 off MSRP - 11" 2TB M5 iPad Pro: $1851 $148 off MSRP For the latest prices and sales, see our iPad Pro Price Tracker, updated daily.

Read more »

Take $283 off Apple’s 16-inch MacBook Pros with the latest sale prices at Amazon
Amazon has 16-inch M4 Pro and M4 Max MacBook Pros (Silver and Black colors) on sale for up to $283 off Apple's MSRP as part of their current sales. Shipping is free. Be sure to select Amazon as the seller, rather than a third-party seller: - 16" M4 Pro MacBook Pro (24GB/512GB/Black): $2239, $260 off MSRP - 16" M4 Pro MacBook Pro (24GB/512GB/Silver): $2249, $250 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Black): $2649, $250 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Silver): $2616, $283 off MSRP These are the lowest sale prices on new 16" Apple MacBook Pros right now. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Mac mini with M4 Pro CPU on sale for $1289, $110 off Apple’s MSRP
Amazon has M4 Pro Mac minis on sale for $110 off Apple's MSRP, only $1289. This model has 24GB of memory and 512GB of SSD storage. Shipping is free. Their price is the lowest currently available for this popular mini: - Mac mini M4 Pro (24GB/512GB): $1289, $110 off MSRP For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Apple’s most affordable iPads are on sale for $50 off MSRP, from $299
Amazon has Apple's 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP right now. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $299 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $599 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Apple AirPods Pro 3 on sale for $199, save $50
Amazon has Apple AirPods Pro 3 on sale for $50 off MSRP, including free shipping: - AirPods Pro 3: $199, $50 off Their price is the lowest we've seen so far for these new AirPods Pro models. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Apple’s 14-inch M5-powered MacBook Pros with 16GB of RAM on sale for $200 off MSRP, starting at $1399
Amazon is offering $200 discounts on new 14" M5 MacBook Pros with 16GB of memory, each including free shipping: - 14" M5 MacBook Pro (16GB/512GB/Black): $1399, MSRP $1599 - 14" M5 MacBook Pro (16GB/512GB/Silver): $1399, MSRP $1599 - 14" M5 MacBook Pro (16GB/1TB/Black): $1599, MSRP $1799 - 14" M5 MacBook Pro (16GB/1TB/Silver): $1599, MSRP $1799 These are the lowest prices available for new M5 MacBook Pros right now. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »