News

Apple to pay $250 million to settle class action lawsuit over delayed ‘more personalized’ Siri

Apple will pay $250 million to settle a class action lawsuit accusing it of false advertising on the promised-then-delayed “more personalized” Siri. In June 2025 Apple shareholder Eric Tucker filed a proposed class action lawsuit against Apple in a California court,...

Broadway adaptation of Apple TV’s canceled music ‘Schmigadoon,’ nominated for 12 Tony awards

Apple TV’s musical comedy “Schmigadoon!” was canceled after two seasons, but the Broadway adaptation has been a big hit. It’s nominated for 12 Tony Awards. They are: Best Musical, Best Performance By An Actress In A Leading Role In A Musical (Sara Chase), Best...

More MacTech News

Opinion

Analyst predicts features of the iPhone 17, iPhone 18, and iPhone 19

Talk about a powerful crystal ball! In a new Medium post, analyst Ming-Chi Kuo offers his predictions for the iPhone 17, iPhone 18, and iPhone 19 that will likely arrive in 2025, 2026, and 2027. He says the high-end iPhone 17 model is expected to feature an upgraded...

More Opinion

Scanners

Wednesday May 06
57 minutes ago
If you bought an iPhone last year, you may have a $95 check coming | Macworld
If you bought an iPhone last year, you may have a $95 check coming
Macworld Remember those Siri ads starring Bella Ramsey that promoted the iPhone 16 by showing off all the cool new Siri features Apple announced at WWDC in 2024? The Siri features that never shipped? Remember those? Well, someone filed a class action lawsuit about those very ads, and Apple has agreed to a $250 million settlement rather than taking it to court. As always, a bunch of that sum will go toward legal and administrative fees, but if you bought an iPhone 15 Pro or iPhone 16, you could have as much as $95 coming your way. If you bought an iPhone 15 Pro or iPhone 15 Pro Max or any iPhone 16 between June 10, 2024, and March 29, 2025, anywhere in the United States, you’re eligible to collect at least $25 and as much as $95, depending on how many people claim their portion of the settlement. Eligible users will be notified will need to provide proof that they’re part of the eligible group. That could be a receipt, serial number, Apple Account information, phone number, or other information, depending on exactly how and where you purchased your iPhone. The settlement received preliminary approval today, and noticed should be sent within the next 45 days. In a statement sent to media outlets, Apple said: Since the launch of Apple Intelligence, we have introduced dozens of features across many languages that are integrated across Apple’s platforms, relevant to what users do every day, and built with privacy protections at every step. These include Visual Intelligence, Live Translation, Writing Tools, Genmoji, Clean Up and many more. Apple has reached a settlement to resolve claims related to the availability of two additional features. We resolved this matter to stay focused on doing what we do best, delivering the most innovative products and services to our users.
Read more »
08:00 am
Don’t drop $2k on a new MacBook Pro—this 5-star rated refurb is only $430 today | Macworld
Don’t drop $2k on a new MacBook Pro—this 5-star rated refurb is only $430 today
Macworld TL;DR: These MacBook Pros are only $430 until they sell out (MSRP $1,999). You don’t need a brand-new MacBook Pro—you just need one that works like new. But with current prices pushing close to $2,000, upgrading can feel out of reach. This refurbished MacBook Pro 2020 offers a smarter path, with strong specs, near-mint condition, and a track record of 5-star reviews. This 13-inch MacBook Pro comes with a 10th Gen Intel Core i5 quad-core processor that runs at 2.0GHz, so everyday work like browsing, video calls, and document editing feels smooth. It has 16GB of RAM and a 1TB SSD, which is plenty of space for apps, photos, and big project files, and it helps the system stay responsive when you have a lot open at once. The 13.3-inch Retina display runs at 2560×1600 resolution with True Tone, so text looks sharp, and colors are vivid while the screen adjusts to the lighting in your room. Intel Iris Plus graphics handle streaming, light creative work, and general use without drama. The backlit Magic Keyboard is comfortable for long typing sessions, and the Touch Bar and Touch ID give you quick shortcuts and fingerprint login. You get four Thunderbolt 3 ports that handle charging, external displays, and fast storage through USB-C. Wireless connections use 802.11ac Wi Fi and Bluetooth 5.0 for modern routers and accessories. This grade “A” refurbished unit should arrive in near-mint condition, with only minor signs of use. It weighs about 3.1 pounds, comes with a charger, and includes a limited third-party warranty. Get a MacBook Pro while they’re on sale for $430. We have fewer than 50 left in stock. Apple Macbook Pro (2020) 13″ i5 2GHz Touchbar 16GB RAM 1TB SSD Space Gray (Refurbished)See Deal StackSocial prices subject to change.
Read more »
04:31 am
Mac Studio loses its craziest memory option | Cult of Mac
Mac Studio loses its craziest memory option
The Mac Studio now tops out at just 96GB of memory, while higher-end Mac mini variants with 32GB or more RAM have also disappeared from sale. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
02:32 am
Intel’s stock jumped 13% today over Apple chip manufacturing report | 9 to 5 Mac
Intel’s stock jumped 13% today over Apple chip manufacturing report
Intel’s stock hit a record high today in the aftermath of a Bloomberg report that claimed Apple is exploring Intel and Samsung Electronics as potential manufacturing partners for future device chips. Here are the details. more…
Read more »
Tuesday May 05
11:00 pm
Apple Agrees To Pay iPhone Owners $250 Million For Not Delivering AI Siri | Slashdot
Apple Agrees To Pay iPhone Owners $250 Million For Not Delivering AI Siri
Apple has agreed to a proposed $250 million settlement over claims that it misled iPhone buyers about the availability of Apple Intelligence and its upgraded Siri features. The settlement would cover U.S. buyers of the iPhone 16 lineup and iPhone 15 Pro models between June 10, 2024, and March 29, 2025. The Verge reports: The settlement will resolve a 2025 lawsuit, alleging Apple's advertisements created a "clear and reasonable consumer expectation" that Apple Intelligence features would be available with the launch of the iPhone 16. The lawsuit claimed Apple's products "offered a significantly limited or entirely absent version of Apple Intelligence, misleading consumers about its actual utility and performance." Apple brought certain AI-powered features to the iPhone 16 weeks after its release, and delayed the launch of its more personalized Siri, which is now expected to arrive later this year. Last April, the National Advertising Division recommended that Apple "discontinue or modify" its "available now" claim for Apple Intelligence. Apple also pulled an iPhone 16 ad showing actor Bella Ramsey using the AI-upgraded Siri. Read more of this story at Slashdot.
Read more »
10:43 pm
Apple pressed by Maryland lawmakers over closure of first unionized U.S. store | 9 to 5 Mac
Apple pressed by Maryland lawmakers over closure of first unionized U.S. store
A group of two U.S. Senators and seven Members of Congress sent a letter to Tim Cook and John Ternus pressing Apple for answers over the planned closure of its Towson retail store. Here are the details. more…
Read more »
10:00 pm
Price cut: Upgrade to Windows 11 Pro for just $10 | Cult of Mac
Price cut: Upgrade to Windows 11 Pro for just $10
Why pay list price for Microsoft software? This Windows 11 sale allows you to upgrade your PC to Windows 11 Pro for just $9.97. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
09:52 pm
Lawsuit over delayed Siri features reaches massive $250M settlement | AppleInsider
Lawsuit over delayed Siri features reaches massive $250M settlement
While Apple's promised Siri overhaul is still nowhere to be found, shareholders who sued over the delay can now rest easy, thanks to a huge settlement.Apple has settled a class-action lawsuit over its delayed Siri features.At WWDC 2024, as part of its Apple Intelligence announcements, Apple previewed major enhancements for Siri. The virtual assistant was supposed to receive an AI-powered cognitive boost, allowing for advanced in-app actions, contextual awareness, and more.The company went so far as to feature Siri's new capabilities in its marketing materials, including video advertisements. Things went south in a matter of months, however. Continue Reading on AppleInsider | Discuss on our Forums
Read more »
09:35 pm
9to5Mac Daily: May 5, 2026 – iOS 26.5 RC, Apple chip partners | 9 to 5 Mac
9to5Mac Daily: May 5, 2026 – iOS 26.5 RC, Apple chip partners
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Bitwarden: Make your life easier with Bitwarden, featuring a secure, open source password manager with end-to-end encryption and seamless autofill across all your devices. more…
Read more »
09:22 pm
Threads starts rolling out DMs on the web, but there are a few catches | 9 to 5 Mac
Threads starts rolling out DMs on the web, but there are a few catches
Last July, Threads finally gave in and uncoupled its DMs from Instagram. Now, the platform is turning to another long-standing gap: bringing DMs to the web. Here are the details. more…
Read more »
09:01 pm
Apple Manufacturing Academy highlights AI adoption across U.S. industry | 9 to 5 Mac
Apple Manufacturing Academy highlights AI adoption across U.S. industry
Apple and Michigan State University recently held the inaugural Spring Forum for the Apple Manufacturing Academy, focused on how AI is being implemented across multiple manufacturing workflows. Here are the details. more…
Read more »
09:01 pm
Software as the Product of Obsession Times Voice | Daring Fireball
Software as the Product of Obsession Times Voice
You might think it counterintuitive that a movement obsessed with software would be spearheading a severe decline in the design quality of software, but in Patel’s definition, there’s no concept of software as art, as a practice, as a craft. Software brain is purely an obsession with software as a medium in and of itself. A means with no consideration for the end.
Read more »
08:48 pm
Apple shares hit new all-time closing high | Mac Daily News
Apple shares hit new all-time closing high
In Nasdaq trading today, shares of Apple Inc. rose to hit a new all-time closing high. Apple’s all-time intraday high was also set today… The post appeared first on MacDailyNews.
Read more »
08:47 pm
Users could get up to $95 per device as Apple reaches $250M settlement over Siri delays | 9 to 5 Mac
Users could get up to $95 per device as Apple reaches $250M settlement over Siri delays
Last March, Apple was hit with a class action lawsuit after delaying the launch of the “more personalized Siri” that was first announced at WWDC 2024. Apple agreed to settle the case in December, and the full settlement terms are now available. Apple is set to pay $250 million to settle the lawsuit, equating to an estimated $25 per device. That number could reach up to $95 per device, depending on how many users submit claims. more…
Read more »
08:22 pm
watchOS 26 added hypertension alerts for Apple Watch, here’s how to use them | 9 to 5 Mac
watchOS 26 added hypertension alerts for Apple Watch, here’s how to use them
watchOS 26 introduced a new hypertension detection feature not only for Apple Watch Ultra 3 and Series 11, but for select older Apple Watch models too. Here’s how to set it up, and which models are compatible. more…
Read more »
08:20 pm
Apple culls more high-end Mac mini, Mac Studio configs | AppleInsider
Apple culls more high-end Mac mini, Mac Studio configs
Apple has pulled even more higher-end configurations of its Mac Studio and Mac mini, removing some of the most expensive memory options as the entire industry deals with the RAM crisis.Apple Mac StudioThe ongoing memory supply problem has claimed another victim from Apple's roster. After the removal of the 512GB RAM option for the Mac Studio in March, Apple has slimmed down its product options a bit more, as component costs bite.This time, it's not just the Mac Studio that's being hit. The Mac mini is also affected by the memory downgrade. Continue Reading on AppleInsider | Discuss on our Forums
Read more »
08:07 pm
Tim Cook’s Apple wasted billions on ‘Apple 2030’ based on now-discredited climate targets | Mac Daily News
Tim Cook’s Apple wasted billions on ‘Apple 2030’ based on now-discredited climate targets
Apple CEO Tim Cook has long positioned “Apple 2030” as a flagship initiative — the company’s ambitious pledge to achieve carbon neutrality… The post appeared first on MacDailyNews.
Read more »
07:59 pm
ChatGPT’s Goblin Obsession Evades OpenAI’s Fixes | TidBITS
ChatGPT’s Goblin Obsession Evades OpenAI’s Fixes
OpenAI has traced ChatGPT’s bizarre goblin fixation to training gone awry, but the creatures keep escaping—as Adam Engst discovered when goblins popped up in a conversation about a conference presentation.Read original article
Read more »
07:31 pm
How Apple will win the AI war | Cult of Mac
How Apple will win the AI war
Apple's AI strategy might be summed up with "Don't beat 'em, join 'em." Here's how iPhone and Mac users will benefit. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
06:54 pm
Canceled Apple TV show might have shot at revival as spinoff wins acclaim | 9 to 5 Mac
Canceled Apple TV show might have shot at revival as spinoff wins acclaim
Apple TV’s musical comedy Schmigadoon! earned a loyal following, but was canceled after two seasons. Now though, a Broadway spinoff has proven a hit and earned significant acclaim, as evidenced by today’s Tony nominations. And that could be good news for a prospective season 3 of Schmigadoon! on Apple TV. more…
Read more »
06:50 pm
Apple lashes out at ‘privacy-threatening’ Digital Markets Act | Macworld
Apple lashes out at ‘privacy-threatening’ Digital Markets Act
Macworld The Digital Markets Act, or DMA, is a piece of EU legislation created with the stated aim of fostering competition and user choice, principally by forcing larger companies to make their products and platforms more accommodating to and interoperable with those made by the smaller ones. Unsurprisingly, it proved unpopular with the tech giants, but despite significant pushback, it came into force in May 2023 and continues to operate to this day. Apple is particularly unhappy about the DMA, which makes it difficult to cultivate digital monopolies and “walled gardens,” such as the iOS app ecosystem. The legislation has consistently pushed Apple towards allowing “sideloading,” or the installation on the iPhone of apps from non-official sources, and thanks to the DMA, users in the EU can even delete the official App Store app. In March 2025, the EU cited the DMA in ordering Apple to open up iOS connectivity features, a decision Apple decried as “bad for our products and for our European users.” Then, in April of the same year, the company was fined roughly $570m after its contract terms concerning alternative app distribution were found to breach the DMA. All in all, the legislation has proved deeply inconvenient for Apple. European regulators, unsurprisingly, do not feel the same. And in the European Commission review of the DMA’s first two years, published at the end of April, it was praised in lavish terms: The DMA has already had a positive impact on the contestability and fairness of digital markets during the short period it has been in application. The DMA has significantly changed the conduct, technical design choices, and contractual arrangements of gatekeepers, which has begun to open up new opportunities for business users and competitors. The DMA has also strengthened end-user autonomy and agency in several key areas by empowering citizens to take back control over their data and make their own choices. All very complimentary. But Apple has now hit back. Speaking in an interview with German-language Handelsblatt, spotted by AppleInsider, Kyle Andeer, Apple’s chief compliance officer and VP of corporate law, accused the review of being “self-serving.” “We had hoped that the review would prompt some sober reflection for the EU,” he said (via Google Translate). But instead, what emerged was “a kind of self-serving defense… After all, they were evaluating their own work.” In the interview, Andeer insisted that the DMA has not yet caused any loss of revenue for Apple, with the key word being yet. But he repeatedly referred to the company’s frustration with the legislation and its fears that users are being put at risk. He pointed out, for example, that the DMA’s interoperability requirements could allow Meta or another social media company to access the Wi-Fi login details of an iOS user, and thereby build a highly tailored user profile without permission. “This is a vulnerability that threatens privacy,” Andeer said, adding that Apple had raised the issue with the EU, but that “they seem to be ignoring it.” Despite Apple’s displeasure, the EU currently appears highly unlikely to kill the DMA. The company has had better luck in its home country; however, only last week we reported on its success lobbying to death a similar bill in California in “little more than a month.”
Read more »
06:48 pm
Apple said to allow users to choose rival AI models across iOS 27, iPadOS 27, and macOS 27 features | Mac Daily News
Apple said to allow users to choose rival AI models across iOS 27, iPadOS 27, and macOS 27 features
Apple is taking a significant step toward making its AI platform more flexible and user-centric. Tthe company plans to let users select and… The post appeared first on MacDailyNews.
Read more »
06:34 pm
Apple’s most powerful Mac Studio loses its last remaining RAM upgrade option | 9 to 5 Mac
Apple’s most powerful Mac Studio loses its last remaining RAM upgrade option
Apple’s most powerful Mac Studio no longer includes RAM upgrade options. This comes after Apple has seemingly ran out of inventory for the two highest memory options supposed by the machine. more…
Read more »
06:30 pm
Trump admin looks to ease memory chip crunch with supply chain bloc | Mac Daily News
Trump admin looks to ease memory chip crunch with supply chain bloc
The United States is partnering with allies in Asia, Europe, and the Middle East to tackle the global memory chip shortage through… The post appeared first on MacDailyNews.
Read more »
06:26 pm
Apple just released new AirPods Max 2 firmware | 9 to 5 Mac
Apple just released new AirPods Max 2 firmware
Last week Apple shipped new firmware for AirPods Pro 3, and now today AirPods Max 2 have gotten a fresh firmware update too. more…
Read more »
06:09 pm
Maryland lawmakers stand with Apple Towson employees after store closure announcement | AppleInsider
Maryland lawmakers stand with Apple Towson employees after store closure announcement
Maryland lawmakers have penned a delegation letter to Apple, asking the tech giant to ask if there were any other paths forward other than closing Apple Towson.Apple Towson employees. Credit: IAMAWApple's battle with its Towson location continues, with Maryland lawmakers stepping in to "express serious concern" over Apple's choice to close the store. On May 4, lawmakers penned a congressional delegation to Apple, which reads:"We urge Apple to reconsider whether there are viable paths forward that would preserve jobs and maintain a retail presence in the region," said the signing members in a letter to Apple. Continue Reading on AppleInsider | Discuss on our Forums
Read more »
06:07 pm
iPhone users will get to select a preferred AI model in iOS 27 | AppleInsider
iPhone users will get to select a preferred AI model in iOS 27
Apple is rumored to be giving users the option to run various AI features in iOS 27 with third-party models as an alternative to Apple Intelligence.iPhone users will get more AI options in iOS 27Apple has been trying to catch up to the rest of the AI market, but it may not have to worry about doing so for iOS 27. If a report is true, Apple will be making it easier to use third-party alternates throughout the operating system.According to sources of Bloomberg on Tuesday, users will be able to select from multiple third-party AI models, which can be used for various tasks in the operating system. It's a change arriving in iOS 27, iPadOS 27, and macOS 27. Rumor Score: 🤯 Likely Continue Reading on AppleInsider | Discuss on our Forums
Read more »
05:49 pm
iOS 27 will let you choose between Gemini, Claude, and more for AI features: report | 9 to 5 Mac
iOS 27 will let you choose between Gemini, Claude, and more for AI features: report
iOS 27 will give users a new way to integrate with third-party AI platforms, according to a new report. This will let iPhone users choose from multiple third-party models from companies like Google and Anthropic, including the ability to set custom voices in Siri depending on which external model is responding. more…
Read more »
05:27 pm
Apple TV 4K, released in 2022, is still the fastest streaming device on the market, bar none – Vice | Mac Daily News
Apple TV 4K, released in 2022, is still the fastest streaming device on the market, bar none – Vice
What you’re looking at is the third-generation Apple TV 4K. Apple launched it back in 2022, and it’s still going strong. Unlike the real… The post appeared first on MacDailyNews.
Read more »
05:27 pm
GPT-5.5 Instant makes ChatGPT more accurate while nixing ‘gratuitous emojis’ | 9 to 5 Mac
GPT-5.5 Instant makes ChatGPT more accurate while nixing ‘gratuitous emojis’
ChatGPT should feel “smarter and more accurate” starting today, according to OpenAI. That’s because the company is replacing the default model with an update called GPT-5.5 Instant. OpenAI also says the model upgrade cuts back on the “gratuitous emojis” in responses. more…
Read more »

Older posts

Wednesday May 06
30 minutes ago
iPhone 17 Outselling Every Other Phone Worldwide So Far This Year | MacRumors
iPhone 17 Outselling Every Other Phone Worldwide So Far This Year
Apple's iPhone 17 was the best-selling smartphone globally in the first quarter of 2026, capturing 6 percent of worldwide unit sales, according to Counterpoint Research's latest Global Handset Model Sales Tracker. The iPhone 17 series dominated the top three spots, with the iPhone 17 Pro Max in second place and the iPhone 17 Pro in third. The previous-generation iPhone 16 also held on at sixth place, suggesting there's still strong demand for the model, following its blockbuster sales run throughout last year. Counterpoint senior analyst Harshit Rastogi credited the iPhone 17's success to upgrades that brought the base model closer to the Pro variants, including higher 256GB base storage, improved cameras, and a faster 120Hz display refresh rate. Not only did the iPhone 17 post double-digit year-over-year growth in China and the U.S., it also tripled its sales in South Korea for the quarter. Samsung's Galaxy A series filled the remaining five spots, led by the budget-friendly Galaxy A07 4G as the best-selling Android phone of the quarter. Xiaomi's Redmi A5 filled out the list in tenth place. Taken together, the top 10 devices accounted for 25% of global smartphone sales -- the highest first-quarter concentration ever recorded, according to Counterpoint. In the meantime, the standard iPhone 17 is set to enjoy a six-month-longer flagship run than usual, with the iPhone 18 expected to see a launch in spring 2027.Related Roundup: iPhone 17Tag: CounterpointBuyer's Guide: iPhone 17 (Neutral)Related Forum: iPhoneThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
Tuesday May 05
11:53 pm
ChatGPT Is Smarter, More Accurate, and Less Obsessed With Emojis After Upgrade | MacRumors
ChatGPT Is Smarter, More Accurate, and Less Obsessed With Emojis After Upgrade
ChatGPT's default model has been updated to GPT-5.5 Instant, a model that brings accuracy improvements with fewer hallucinations, especially in areas like medicine, law, and finance, according to OpenAI. GPT-5.5 Instant is more capable at tasks like analyzing images, answering STEM questions, and choosing when to use web search to provide a better answer. Responses can also be personalized because GPT-5.5 Instant can better draw context from past chats, files, and Gmail, but this is currently limited to paid subscribers. OpenAI says that responses are "tighter and more to-the-point without losing substance" and without eliminating ChatGPT's personality. It will provide the same information, but without unnecessary formatting, emojis, and follow-up questions. All ChatGPT models are being updated with memory sources, which will show users the past chats, files, and other context that ChatGPT used to generate a response. GPT-5.5 Instant is rolling out today to all ChatGPT users, and it is replacing GPT-5.3 Instant as the default model. While free users can access GPT-5.5 Instant, the new personalization features are limited to Plus and Pro users on the web. Personalization will expand to mobile soon, and it will roll out to Free, Go, Business, and Enterprise users in the coming weeks. It's not yet clear when Apple Intelligence's ChatGPT integration will switch to GPT-5.5 Instant.Tags: ChatGPT, OpenAIThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
09:01 pm
Apple to Pay $250 Million to Settle Class Action Over Delayed Siri Features | MacRumors
Apple to Pay $250 Million to Settle Class Action Over Delayed Siri Features
Apple will pay $250 million to settle a class action lawsuit accusing it of false advertising and unfair competition after the personalized Siri features it promoted when launching the iPhone 16 were delayed. A smarter, Apple Intelligence version of ‌Siri‌ was shown off at WWDC 2024, and then promoted in ads and videos when the ‌iPhone 16‌ launched in September 2024. After Apple delayed the Siri Apple Intelligence features in March 2025, Apple pulled its ads, but they had been running for several months at that point. The lawsuit claimed Apple violated consumer law by misleading consumers about the actual utility and performance of ‌Apple Intelligence‌, and causing them to purchase a device "with features that did not exist or were materially misrepresented." Apple was not found guilty of any wrongdoing, and the company sometimes settles lawsuits to minimize legal fees and time spent on litigation. A settlement agreement was reached back in December, but the terms of the settlement are now live. In a statement to MacRumors, Apple said that resolved the lawsuit so that it could focus on its products and services, and reiterated that it has introduced multiple ‌Apple Intelligence‌ features since 2024.Since the launch of Apple Intelligence, we have introduced dozens of features across many languages that are integrated across Apple's platforms, relevant to what users do every day, and built with privacy protections at every step. These include Visual Intelligence, Live Translation, Writing Tools, Genmoji, Clean Up and many more. Apple has reached a settlement to resolve claims related to the availability of two additional features. We resolved this matter to stay focused on doing what we do best, delivering the most innovative products and services to our users.Apple's $250 million payment will provide U.S. Settlement Class Members who submit Claim Forms with a per-device payment of $25 for each eligible device, though that could increase up to $95 per device if claim volume is low. Eligible devices include ‌iPhone 16‌, iPhone 16e, ‌iPhone 16‌ Plus, ‌iPhone 16‌ Pro, ‌iPhone 16‌ Pro Max, iPhone 15 Pro, or iPhone 15 Pro Max models purchased between June 10, 2024, and March 29, 2025. The settlement has received preliminary approval, and notices to those eligible to make a claim will start to receive email notices no more than 45 days from today.Tags: Apple Lawsuits, SiriThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
07:34 pm
Apple Cuts More Mac Studio and Mac Mini RAM Options as Memory Shortage Worsens | MacRumors
Apple Cuts More Mac Studio and Mac Mini RAM Options as Memory Shortage Worsens
Apple has removed two desktop Macs from its online store as the global memory shortage continues. The Mac mini with 64GB of RAM is no longer available for purchase, nor is the M3 Ultra Mac Studio with 256GB RAM. The M3 Ultra Mac Studio is now available only in a 96GB RAM configuration, with higher-tier options eliminated. Both M3 ‌Mac Studio‌ and M4 Max ‌Mac Studio‌ models have delivery estimates of 9 to 10 weeks. As for the ‌Mac mini‌, the M4 Pro model now maxes out at 48GB of RAM, with customers no longer able to choose the 64GB option. Last week, Apple removed the ‌Mac mini‌ with 256GB of SSD storage, leaving the 512GB model as the minimum option. That effectively raised the price of the ‌Mac mini‌ from $599 to $799. Apple stopped accepting orders for some ‌Mac Studio‌ and ‌Mac mini‌ machines with higher amounts of RAM in March and April. Apple CEO Tim Cook recently said that the ‌Mac mini‌ and the ‌Mac Studio‌ are going to be hard to get for months to come. "We think, looking forward, that the ‌‌Mac mini‌‌ and ‌‌Mac Studio‌‌ may take several months to reach supply demand balance," Cook said. According to Cook, Apple underestimated the demand for the ‌Mac mini‌ and the ‌Mac Studio‌ from customers looking for a machine to run AI and agentic tools locally. He said Apple also expects significantly higher memory costs in the months to come, so Apple is likely conserving supply by eliminating some configuration options. Global supply constraints caused by AI server demand have impacted the pricing of memory chips, leading to high prices and memory shortages.Related Roundups: Mac Studio, Mac miniBuyer's Guide: Mac Studio (Caution), Mac Mini (Caution)Related Forums: Mac Studio, Mac miniThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:16 pm
Apple Releases New Firmware for AirPods Max 2 | MacRumors
Apple Releases New Firmware for AirPods Max 2
Apple today released new firmware for the AirPods Max 2. The firmware is version 8E258, up from the prior 8E251 firmware that was released just ahead of when the ‌AirPods Max 2‌ launched. It's not clear what's included in the firmware update, but Apple provides limited details in its AirPods firmware support document. Most updates focus on bug fixes and improvements. The ‌AirPods Max 2‌ have an H2 chip, an upgrade over the H1. The H2 brings several new features like Live Translation, Adaptive Audio, Loud Sound Reduction, Voice Isolation, and more. To get the new firmware, make sure your AirPods are in range of your iPhone, iPad, or Mac and are connected via Bluetooth. From there, connect the Apple device to Wi-Fi, then connect the AirPods Max to power with a USB-C cable. Keep the AirPods Max in Bluetooth range of the Apple device, and wait at least 30 minutes for the firmware to update. From there, reconnect the AirPods to the Apple device, and check the firmware version to see if it's updated. Apple says if the firmware doesn't install, to restart the AirPods Max and try again.Related Roundup: AirPods Max 2Buyer's Guide: AirPods Max (Buy Now)Related Forum: AirPodsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:04 pm
iOS 27 Will Let You Pick Claude or Gemini Instead of ChatGPT for Apple Intelligence | MacRumors
iOS 27 Will Let You Pick Claude or Gemini Instead of ChatGPT for Apple Intelligence
iOS 27, iPadOS 27, and macOS 27 will let users set third-party AI services as the default for Apple Intelligence features like Writing Tools and Image Playground, reports Bloomberg. Apple has signed a deal with Google and plans to use a Gemini-based model for ‌Apple Intelligence‌ and Siri features in ‌iOS 27‌, but users will also be able to choose their favorite AI service as an alternative. Apple has already partnered with OpenAI to make ChatGPT available in lieu of Apple's built-in options for ‌Siri‌, Writing Tools, and ‌Image Playground‌ on iOS 26, but in Apple's upcoming software updates, other third-party chatbots like Claude and Gemini will also be available. Instead of being limited to ChatGPT, users will select their preferred AI service. Users can choose any AI provider that adds support for Apple's new ‌iOS 27‌, iPadOS 27, and ‌macOS 27‌ "Extensions" feature. From Bloomberg: "Extensions allow you to access generative AI capabilities from installed apps on demand, through Apple Intelligence features such as Siri, Writing Tools, Image Playground and more," according to a message shown in test versions of the software. Apple also plans to let users choose voices from third-party AI services for ‌Siri‌, which would make it clearer whether ‌Siri‌ or another AI product like Gemini is responding. ‌Siri‌ would use one voice, while responses from third-party AI options would use another voice. Apple has many other AI-related changes planned for ‌iOS 27‌, with details available in our iOS 27 roundup.Related Roundup: iOS 27Tags: Apple Intelligence, ChatGPTThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:37 pm
iPhone Air MagSafe Battery Hits $59.99 Low Price | MacRumors
iPhone Air MagSafe Battery Hits $59.99 Low Price
Following a few steep discounts on the iPhone Air last month, we're now tracking a new all-time low price on the iPhone Air MagSafe Battery on Amazon. You can get the accessory for $59.99, down from $99.00, beating the previous low price by about $20. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. The iPhone Air MagSafe Battery is only compatible with the iPhone Air, and it can add up to 65 percent additional charge to the smartphone. The MagSafe Battery supports up to 12W of fast wireless charging, and it sports a thin and light design similar to the iPhone Air. $39 OFFiPhone Air MagSafe Battery for $59.99 Apple heavily discounted the iPhone Air in both the United Kingdom and United States in late March and early April, providing as much as 30 percent off the device. There have been multiple reports regarding low sales for the iPhone Air, with one stating there is "virtually no demand" for the smartphone. If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:06 pm
Maryland Lawmakers Press Apple Over Decision to Close Unionized Store | MacRumors
Maryland Lawmakers Press Apple Over Decision to Close Unionized Store
In a letter sent to Apple's CEO Tim Cook and hardware engineering chief John Ternus this week, nine members of U.S. Congress from Maryland expressed "serious concern" regarding Apple's decision to close its unionized retail store in Towson, Maryland on June 20, without plans to open a replacement store within the Baltimore region. Apple Towson Town Center "We recognize that decisions of this scale involve complex business considerations," the lawmakers said. "However, we urge Apple to reconsider whether there are viable paths forward that would preserve jobs and maintain a retail presence in the region. Maryland residents value employers who invest in their workforce and demonstrate a sustained commitment to the communities they serve. We stand ready to engage constructively with Apple to better understand this decision and to explore potential solutions." The letter was signed by nine of Maryland's lawmakers, including two senators and seven representatives, all from the Democratic Party. They said it was their understanding that Apple's store at the Towson Town Center has been in "a strong-performing location," but several local news reports have stated that the shopping mall is in decline and has lost major retailers like Tommy Bahama, Banana Republic, and Madewell. In the letter, the lawmakers said the store's closure will "significantly affect" residents and small businesses across the Baltimore region, including approximately 90 employees. As a result, they asked for Apple to provide a clearer understanding of the rationale behind this decision, including whether alternatives such as relocating the store or other operational adjustments were meaningfully considered. Last month, Apple announced that it will be permanently closing three retail stores in the U.S. in June, with the other two locations set to close beyond Apple Towson Town Center being Apple Trumbull in Trumbull, Connecticut and Apple North County in Escondido, California. Apple said it made this difficult decision following the "departure of several retailers" and declining conditions" at all three of the shopping malls. Notably, the staff at the Towson store became Apple's first retail employees in the U.S. to unionize in 2022. They belong to the International Association of Machinists and Aerospace Workers' Coalition of Organized Retail Employees (IAM CORE), and they signed a collective bargaining agreement with Apple in 2024. Apple said employees at the Trumbull and North County stores will "continue their roles" at the company's nearby stores in each area, so transfer eligibility is guaranteed. Meanwhile, Apple said employees at the Towson store will be eligible to apply for open roles at Apple in accordance with their collective bargaining agreement, and it is unclear if everyone who applies will successfully secure a new position at the company. Last month, the IAM union filed an unfair labor practice charge with the National Labor Relations Board (NLRB), citing discriminatory treatment against unionized workers at the Towson store. Unlike workers at two other closing stores, Apple has not offered its unionized Towson employees the opportunity to transfer to other stores. IAM said Apple not offering Towson employees the opportunity to transfer "raises serious concerns that this closure is a cynical attempt to bust the union." "We praise the Maryland congressional delegation for having these workers' backs and demanding answers from Apple," said IAM Union International President Brian Bryant. "These workers made history by exercising their right to organize for a voice on the job. Walking away from them now sends a dangerous message to working people everywhere." Apple has said it is simply respecting the terms of the bargaining agreement. According to Apple, the contract that the union agreed to states that in the event of a store closure, Apple would transfer or rehire employees if the company opened a new store within 50 miles of the current location at Towson Town Center. In any other circumstance, the union negotiated for employees to receive severance. Apple has no current plans to open a new store in the area, but if it were to do so within the next 18 months, the affected employees would have the right of first refusal. "We strongly disagree with the claims made, and we will continue to abide by the agreement that was negotiated and agreed with the union," an Apple spokesperson said. "We look forward to presenting all of the facts to the NLRB."Tag: Apple StoreThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:41 pm
iPhone 18 Pro Rumored to Keep Aluminum Finish Amid Durability Complaints | MacRumors
iPhone 18 Pro Rumored to Keep Aluminum Finish Amid Durability Complaints
The iPhone 18 Pro will reportedly carry over the same anodized aluminum finish introduced with the iPhone 17 Pro, despite concerns from some users about its durability. According to the Weibo leaker known as "Fixed Focus Digital," surface chipping on the ‌iPhone 17 Pro‌ has become a common complaint, and that users who have sought recourse from Apple have been told they cannot claim it, with the company classifying the issue as an inherent characteristic of the aluminum alloy material and normal wear and tear. Crucially, they added that the ‌iPhone 18 Pro‌ will "continue to utilize this same design approach" despite its weaknesses. The ‌iPhone 17 Pro‌ moved away from the titanium frames Apple used in its Pro lineup for the previous two years, adopting an anodized aluminum unibody design. Surface durability concerns surfaced almost immediately after launch. Reports suggested that Dark Blue and Cosmic Orange models appeared to scratch more easily than other finishes, with MacRumors forum users describing visible marks on in-store display units within days of availability. A scratch test by YouTuber JerryRigEverything added some nuance, finding that most of the anodized shell holds up well against everyday items like keys and coins, but pinpointing the camera plateau as a clear weak point where the raised, unchamfered edges chip and scratch easily. A separate issue emerged the following month, when a number of Cosmic Orange iPhone 17 Pro owners reported color shift, with the aluminum frame and camera plateau drifting toward a rose-gold or pink hue and in some cases prompting device replacements by Apple Support. Rumors point to four color options for the ‌iPhone 18 Pro‌ models: Dark Cherry, Light Blue, Dark Gray, and Silver. Dark Cherry is expected to serve as the signature new color, described as a deep, wine-like red that is considerably more muted than last year's Cosmic Orange. The ‌iPhone 18 Pro‌ is not expected to offer a black option for the second consecutive year, but the rumored gray option could come close. The ‌iPhone 18 Pro‌ and ‌iPhone 18 Pro‌ Max are expected to be announced in September 2026, alongside the first foldable iPhone.Related Roundup: iPhone 18 ProTag: Fixed Focus DigitalThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:24 pm
PSA: Instagram Encrypted Messaging Ends on Friday, May 8 | MacRumors
PSA: Instagram Encrypted Messaging Ends on Friday, May 8
Instagram will remove end-to-end encryption for direct messages between users from May 8, 2026. When the date comes around, Meta will potentially be able to see the contents of all messages between users on the social media platform. Encrypting messages has been an optional feature in Instagram since 2023, but in March of this year the social media platform quietly updated a help page to say the feature would no longer be available for direct messages between users from May 8. With end-to-end encryption enabled, the contents of messages are protected from the moment they leave the sender's device to the moment they reach the receiver's device. In other words, nobody, including Meta, can see what is sent. When May 8 rolls around, that extra layer of security will be removed. On its help page, Instagram says users that are affected by the change will see instructions in the app on how they can download any media or messages that they may want to keep. However, the company hasn't explained why encrypted chats must be downloaded before the cutoff date or what will happen to them afterwards. In March, a spokesperson for Meta told The Guardian that the decision to abandon encryption was due to low uptake. "Very few people were opting in to end-to-end encrypted messaging in DMs, so we're removing this option from Instagram in the coming months," the spokesperson said. "Anyone who wants to keep messaging with end-to-end encryption can easily do that on WhatsApp." Meta has come under sustained pressure over the years from law enforcement and child safety groups to remove encryption, but there's likely more to it than that. With Meta able to see messages between users, it could potentially run advertising algorithms or train chatbots on their contents. It's an odd twist for a company who in 2019 aggressively promoted tightening encryption standards on its social media and messaging apps. As things stand, end-to-end encryption for group Facebook Messenger chats remains opt-in, while it continues to be the default setting for all WhatsApp conversations and calls.Tags: Encryption, Instagram, SecurityThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:56 pm
watchOS 26.5 Fixes Two Apple Watch Bugs | MacRumors
watchOS 26.5 Fixes Two Apple Watch Bugs
watchOS 26.5 fixes two Apple Watch bugs, according to Apple's release notes for the update, which is expected to be released next week. Apple fixed bugs in the Messages and Workout apps:• Fixes an issue where Messages on Apple Watch may use SMS instead of iMessage when paired with a dual SIM iPhone • Fixes an issue where Workout app audio alerts could fail to play if the phone was not nearby Apple WatchThe notes also mention the new Pride Luminance watch face available on watchOS 26.5. The watch face has a customizable layout and colors. Given that the watchOS 26.5 Release Candidate was seeded this week, it is likely that Apple will make the update available to all users next week.Related Roundups: Apple Watch 11, watchOS 26Buyer's Guide: Apple Watch (Neutral)Related Forum: Apple WatchThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:36 pm
Apple Says iOS 26.5 Adds Three New Features to Your iPhone | MacRumors
Apple Says iOS 26.5 Adds Three New Features to Your iPhone
iOS 26.5 includes three new features for iPhones, according to Apple's release notes for the update, which is expected to be released next week. As discovered during beta testing, iOS 26.5 enables end-to-end encryption for RCS messaging between iOS and Android devices. Apple says this security upgrade is limited to supported carriers around the world and will continue to roll out. End-to-end encryption for ‌RCS‌ is a security layer that ensures that messages sent between supported iOS and Android devices are encrypted and cannot be intercepted and read by Apple or any third party while they are being delivered. Keep in mind that text messages sent via the older SMS standard still lack end-to-end encryption. iMessage conversations with blue bubbles have already been end-to-end encrypted since iOS 5. The second new feature added in iOS 26.5 is "Suggested Places" in Apple Maps. This section of the app provides recommendations based on your location and recent searches, and it will start showing ads in the U.S. and Canada later this year. Similar to the ads that are already shown in App Store search results on the iPhone and iPad, ads in Apple Maps will have an "Ad" label, and Apple promises strong privacy protections. For example, Apple says a user's location and the ads they see and interact with in Apple Maps are not associated with a user's Apple Account. Third, a new Pride Luminance wallpaper that "dynamically refracts a spectrum of colors" is available to download on iPhones and iPads running iOS 26.5 or iPadOS 26.5. Released alongside a new Pride Edition Sport Loop and Pride Luminance watch face, Apple says the wallpaper celebrates LGBTQ+ communities around the world. Here are Apple's full release notes for iOS 26.5:This update includes the following enhancements: • End-to-end encrypted RCS messaging (beta) in Messages is available with supported carriers and will roll out over time • Pride Luminance wallpaper that dynamically refracts a spectrum of colors, is available for download • Suggested Places in Maps displays recommendations based on what's trending nearby and your recent searchesGiven that the iOS 26.5 Release Candidate was released this week, it is likely that Apple will make the update available to all users next week.Related Roundups: iOS 26, iPadOS 26Related Forum: iOS 26This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:13 pm
Mother's Day Deals Include Low Prices on AirPods, Apple Watch, iPhone Chargers, and More | MacRumors
Mother's Day Deals Include Low Prices on AirPods, Apple Watch, iPhone Chargers, and More
This year, Mother's Day lands on Sunday, May 10, and we're tracking quite a few offers from some of the best Apple-related accessory companies, as well as steep discounts on Apple products at Amazon. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Apple Deals There are numerous Apple discounts on Amazon this week, with all-time low prices on AirPods Pro 3, AirPods Max 2, iPad, iPad Air, and MacBook Air. Most of these still have free delivery dates before Mother's Day, but be sure to order soon to ensure arrival before Sunday. AirPods Pro 3 - $199.99 ($49 off) AirPods Max 2 - $509.00 ($40 off) Apple Watch Series 11 - $299.00 ($100 off) 11-inch iPad - $299.00 ($50 off) M4 iPad Air - $519.99 ($79 off) M5 MacBook Air - $949.00 ($150 off) Accessory Deals In other deals, we're tracking a big collection of Mother's Day sales from retailers like Best Buy, Belkin, ZAGG/Mophie, Verizon, and more. This year you can save 25 percent on OtterBox accessories sitewide, up to 30 percent on Belkin charging devices, and up to 40 percent on Anker products. Anker - Get up to 40% off charging accessories AT&T - Get iPhone 17 Pro Max for up to $1,100 off Best Buy - Save on everything from wearable tech to TVs and more Belkin - Get up to 30% off Casetify - Buy two get 20% off Grid Studio - Get 15% off sitewide Hyper - Get 20% off select products Nimble - Get 20% off with code MOM20 OtterBox - Get 25% off sitewide Verizon - Get iPhone 17, iPad, and Apple Watch Series 11 for no cost when switching ZAGG - Get 25% off screen protectors and cases If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:27 pm
Apple Manufacturing Academy Hosts AI Showcase | MacRumors
Apple Manufacturing Academy Hosts AI Showcase
Apple this week held the inaugural Spring Forum for its Manufacturing Academy in East Lansing, Michigan, gathering hundreds of U.S. manufacturers at Michigan State University to demonstrate how businesses are applying AI techniques learned through the program. The event was the academy's largest to date. Offsite tours formed a central part of the program, with Block Imaging, a Michigan company that services and refurbishes medical imaging equipment including CT scanners and MRI machines, hosting attendees at its facility to show how it has put the academy's training to use on the factory floor. Other stops included the MSU Facility for Rare Isotope Beams and Peckham. On-campus sessions featured speakers from McKinsey, Magna, LightGuide, and Medtronic on topics including physical AI in manufacturing and the challenges of scaling AI solutions. A poster session closed the day, featuring MSU students and small- and medium-sized business participants. Priya Balasubramaniam, Apple's vice president of Product Operations, spoke at the forum and took part in a fireside chat with Michigan State University president Kevin M. Guskiewicz, covering AI's impact on manufacturing operations and the skills workers will need in an AI-enabled economy. Block Imaging's director of Technical Training, Katie Runyon, said the program had produced tangible results for her team: The Apple Manufacturing Academy has had a direct impact on how we operate. The training we've received from Apple engineers and Michigan State experts has given our team practical tools and techniques we've been able to apply immediately on the floor, improving the way we work and the quality of what we deliver to healthcare providers. We keep coming back because the program continues to push us forward. Launched last year as part of Apple's $500 billion U.S. investment commitment, the Manufacturing Academy is a free program pairing Apple engineers and MSU experts with small- and medium-sized businesses to help them implement AI and smart manufacturing techniques. It is the only such academy in North America and is open to businesses nationwide. To date, it has supported more than 150 companies through dozens of in-person training sessions, and recently added virtual programming.Tag: American Manufacturing ProgramThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:01 pm
iPhone 18 Downgrades Rumored Yet Again | MacRumors
iPhone 18 Downgrades Rumored Yet Again
The standard iPhone 18 and the lower-cost iPhone 18e are said to share components, according to the leaker known as "Fixed Focus Digital," as further evidence that Apple is narrowing the gap between the two devices. In new posts on Weibo, Fixed Focus Digital said that certain parts are interchangeable between the two models, adding that the information originates from a reliable manufacturing source. The leaker described the component overlap as confirmation that the specification convergence between the ‌iPhone 18‌ and iPhone 18e is real and measurable at the supply chain level. "Take it from me: The standard ‌iPhone 18‌ model has been downgraded and its launch delayed-this decision is final and will not change," they added. The posts also suggested that if the ‌iPhone 18‌ ships in spring 2027 rather than alongside the Pro models in the fall, September and October will effectively become "flagship season" for Apple, a window occupied by the iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and the foldable "iPhone Ultra." A split launch strategy separating the Pro and standard models has been widely reported since last year, with Ming-Chi Kuo and Nikkei among those to have corroborated the plan. The component sharing claim builds on a string of downgrade reports over the past two weeks. The leaker first reported that Apple is implementing certain manufacturing downgrades to the ‌iPhone 18‌ as a cost-cutting measure, before adding that display specifications and the chip will both be affected. Apple could be planning to tweak the name of the A-series chip used in the device to obscure the extent of the chip change. Engineering Validation Testing of the ‌iPhone 18‌ and iPhone 18e is said to be taking place simultaneously in June, which aligns with the idea that the two devices now share significant engineering overlap. Today, the iPhone 17 and iPhone 17e are meaningfully different devices: the standard model features a 6.3-inch display with ProMotion and up to 3,000 nits of peak outdoor brightness, the Dynamic Island, a five-core GPU, an Ultra Wide camera, and significantly better battery life. The ‌iPhone 17e‌, by contrast, has a smaller 6.1-inch display, a notch rather than a ‌Dynamic Island‌, no ProMotion, a four-core GPU, and no Ultra Wide camera. If Apple is now sharing components between the ‌iPhone 18‌ and iPhone 18e and reducing display and chip specifications on the standard model, many of those distinctions could shrink or disappear entirely in the next generation. The ‌iPhone 18‌, iPhone 18e, and iPhone Air 2 are all expected to launch in spring 2027, with the ‌iPhone 18 Pro‌, ‌iPhone 18 Pro‌ Max, and iPhone Ultra anticipated to be announced in the fall.Related Roundup: iPhone 18Tag: Fixed Focus DigitalRelated Forum: iPhoneThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
12:18 pm
OpenAI Fast-Tracking AI Phone for 2027 Launch, Says Kuo | MacRumors
OpenAI Fast-Tracking AI Phone for 2027 Launch, Says Kuo
OpenAI is said to be fast-tracking development of its first "AI agent phone," with the company now aiming to mass produce the device as early as the first half of next year, according to industry analyst Ming-Chi Kuo. Late last month, Kuo revealed OpenAI's work on a smartphone, contradicting earlier reports that the company had no plans to enter the mobile market. Kuo said MediaTek and Qualcomm are the chosen chip partners and Luxshare Precision Industry is the exclusive manufacturing partner, with mass production scheduled for 2028. Reasons for Kuo's revised 1H27 production target are now said to include OpenAI's planned initial public offering (i.e. a compelling hardware product could strengthen its story to investors if it goes public) and intensifying competition in AI agent phones. Kuo says MediaTek appears "better positioned to become the sole processor supplier," with the device set to use a customized version of the Dimensity 9600, which will apparently be built on TSMC's N2P node in 2H26. The device's "headline spec" will allegedly be its image signal processor, featuring an enhanced HDR pipeline that improves real-world sensing - or what the AI "perceives" through the camera. The phone will also use two AI processors for handling different tasks (e.g. vision and language simultaneously), fast memory and storage, and security features to isolate processes. "If development stays on track, combined 2027-2028 shipments could reach around 30 million units," says Kuo, who argues that fully controlling both the operating system and the hardware is the only way for the company to deliver a comprehensive AI agent service. Kuo expects AI agents to change how people interact with a phone, shifting the focus from launching individual apps to completing tasks within a seamless context-aware interface. Quite where this leaves Jony Ive's non-phone AI device prototype isn't entirely clear. Shortly after its acquisition of Ive's startup io Products in May 2025, OpenAI engaged in something of a marketing blitz to promote Ive's first upcoming product for the company, describing it as a "third core device" after a MacBook Pro and an iPhone. According to OpenAI CEO Sam Altman, it would be the "coolest piece of technology that the world will have ever seen." And crucially, it wouldn't have a screen - because phones have screens, and Ive and Altman want to wean people off those. The original goal was to release the device later this year, but in November that roadmap got pushed back to "less than two years." The last we heard, Ive's first OpenAI device was revealed to be a smart speaker with a camera, set to come out in early 2027. Other OpenAI products reportedly in development include smart glasses, a smart lamp, and potentially earbuds, but the roadmap is supposed to be further out for those. If any of these devices eventually launch, OpenAI will become a direct hardware rival against several Apple product lines - Apple is rumored to be also working on smart glasses, AirPods with cameras, and an AI pendant, as well as a smart home hub with enhanced Siri capabilities.Tags: Ming-Chi Kuo, OpenAIThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
10:55 am
20th Anniversary iPhone Could Blend Haptic Buttons Into Curved Edges | MacRumors
20th Anniversary iPhone Could Blend Haptic Buttons Into Curved Edges
For the rumored 20th-anniversary iPhone, Apple continues to test a solid-state haptic button system that will replace traditional mechanical buttons and enhance the uninterrupted look of the device's display, claims Chinese leaker "Instant Digital." According to the Weibo-based leaker, the buttons have already passed tests for use when wearing gloves or having wet hands, in extreme temperatures, and when the phone has a case on. The leaker also claims that the 20th-anniversary iPhone will be equipped with an ultra-low energy microprocessor allowing the solid-state buttons to remain functional even when the handset is powered off or the battery has run out. It's not the first time Instant Digital has said solid-state buttons will feature on the device. The leaker made the same claim in October 2025, saying that Apple's solution would include haptic feedback for the Side button, volume buttons, Action button, and Camera Control button. Apple is reportedly working on a display that curves down around all four edges of the device for a borderless visual experience - and solid-state haptic buttons could help in Apple's apparent desire to create a device that looks like a slab of glass with no cutouts and no bezels. That said, Apple's adoption of solid-state buttons has been repeatedly rumored for an iPhone, but with nothing to show for it. Back in 2022, several reports suggested Apple intended to bring solid-state buttons to the iPhone 15 Pro in 2023 as part of "Project Bongo." However, the plan was reportedly canceled at a late stage. They were then rumored to come to the iPhone 16 Pro, before being shelved indefinitely. In the same Weibo post, the leaker went on to list other features that have been repeatedly rumored for the 2027 device, such as a dual-layer OLED panel, under-display Face ID, and an under-display front-facing camera. They also mentioned a 6,000mAh battery, under-display audio (eliminating the earpiece slit), reverse wireless charging, and a next-generation Ceramic Shield - although it's unclear whether these last few items are more of a wish list of features rather than being based on new supply chain information. Instant Digital has a generally good track record for Apple rumors and has provided some accurate information ahead of time, such as the imminent launch of 2023's Yellow iPhone 14, as well as the frosted back glass of the iPhone 15 and iPhone 15 Plus. The 20th anniversary iPhone will presumably come out in the fall of 2027.Tags: 20th-Anniversary iPhone, Instant DigitalThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
09:32 am
Apple Eyes Intel and Samsung as Backup US Chipmakers | MacRumors
Apple Eyes Intel and Samsung as Backup US Chipmakers
Apple has held "exploratory" talks with Intel and Samsung about manufacturing the main processors for its devices in the United States, reports Bloomberg ($). Apple is said to have had early-stage talks with Intel about using its chipmaking services, while Apple executives have reportedly visited a Samsung plant under construction in Texas that will also make advanced chips. The talks are said to be preliminary, and no orders have been made so far, according to the report's sources who asked not to be identified. Apple is also said to have concerns about using technology that is not made by its longtime chip partner, Taiwan Semiconductor Manufacturing Company (TSMC), so the talks could still go nowhere. Apple is said to be seeking potential additional suppliers beyond TSMC as a way to avoid recent shortages almost entirely driven by the current build-out of AI data centers. Heavy demand for Mac mini and Mac Studio models - sought-after because of their suitability for running local AI models - is also said to have been another factor. On an earnings call last week, Apple CEO Tim Cook acknowledged that Mac mini and Mac Studio supply is constrained, and he said it may take "several months" for Apple to achieve supply-demand balance. Neither Intel nor Samsung can reliably provide the kind of production and scale that TSMC offers, so it's not clear how much, if anything, will come out of the discussions. Apple has already worked with TSMC to help expand its plant in Phoenix, which is now producing a limited number of chips for Apple and expects to make 100 million chips for the company in 2026.Tags: Bloomberg, Intel, SamsungThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
Monday May 04
11:08 pm
Apple Asks Supreme Court to Pause Epic Games Case Ahead of App Store Fee Ruling | MacRumors
Apple Asks Supreme Court to Pause Epic Games Case Ahead of App Store Fee Ruling
Apple today filed an emergency application with the Supreme Court, asking for a stay on App Store fee calculations while it waits to hear whether the Supreme Court will weigh in on the latest developments in its legal battle with Epic Games. Apple argues that without a stay, it will face irreparable harm. Apple says it will have to litigate the fundamentals of its business model with the "highly prejudicial taint of being (improperly) found to have acted in contempt of the court's initial order" with the world watching, plus the case would require it to disclose confidential business information, which can't be undone. Regulators around the world are watching this case to determine what commission rate Apple may charge on covered purchases in huge markets outside the United States. No proceeding setting the commission Apple may charge--an endeavor that itself is fraught with challenges and raises the prospect of the courts engaging in improper rate-setting--should be allowed to unfold under the false and prejudicial auspices that Apple acted in contempt by charging a commission based on an injunction that did not even mention commissions. The Supreme Court's finding could also affect the scope of the case, because one of Apple's arguments is that the injunction should only apply to ‌Epic Games‌, not all developers that distribute apps in the United States. For a recap, in 2021, the U.S. Northern District Court of California ordered Apple to relax its anti-steering rules as part of the ruling in the ‌Epic Games‌ v. Apple case. Apple was told to allow developers to link to alternate payment options in apps. Apple complied, but still charged high fees (three percent less than its standard fees), leading the court to find Apple in contempt of court for willfully violating the injunction. In April 2025, Apple was barred from collecting any fees on links in apps in the U.S. ‌App Store‌, a change Apple implemented the same month. Apple appealed, and the Ninth Circuit Court of Appeals agreed Apple violated the injunction, but said the company should be able to receive compensation for its technology. The appeals court then ordered the district court to calculate a reasonable fee, and that's what Apple wants to pause. Apple is planning to challenge the district court's contempt of court ruling and the scope of the injunction, and it does not want to go to court for fee calculations when there's a chance the Supreme Court could vacate the decision entirely. All Apple seeks here is a stay of the mandate so this Court can consider Apple's petition before it is subjected to a remand proceeding that could reshape the global app market based on the false premise that Apple engaged in civil contempt. Apple asked the appeals court to stay the fee calculation phase until it heard back from the Supreme Court. The appeals court agreed initially, but then reversed course after ‌Epic Games‌ challenged the decision. Apple is now asking the Supreme Court for the same stay that the appeals court denied. Apple wants to keep its current zero-fee link-out commission structure in place while it appeals to the Supreme Court, which means developers in the U.S. would continue to pay no fees for purchases made using third-party payment options in their apps while the case plays out. If the Supreme Court grants Apple's request for a stay, the zero-fee setup will remain in place while Apple waits on a decision from the Supreme Court. If the Supreme Court does not grant the stay or declines to hear the case, Apple and ‌Epic Games‌ will return to the district court to determine the reasonable fee that Apple can collect. While Apple is asking the Supreme Court for a stay as it prepares a full filing, Apple has also suggested that its filing could be used as a certiorari petition, so we could soon hear whether the Supreme Court will decide to hear the ‌Epic Games‌ v. Apple case. Apple will not be able to submit a petition for certiorari that will be considered before the summer recess. The mandate that will send Apple back to the district court for fee calculations goes into effect on May 5.Tags: App Store, Epic Games vs. Apple, Apple LawsuitsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
08:09 pm
T-Mobile Customers Can Now Use Satellite Connectivity in Canada and New Zealand | MacRumors
T-Mobile Customers Can Now Use Satellite Connectivity in Canada and New Zealand
T-Mobile's Starlink satellite connectivity is now available for T-Mobile users who are traveling in Canada and New Zealand. T-Mobile users have previously had access to cellular connectivity through roaming agreements in Canada and New Zealand, and now T-Satellite connectivity is included. Canada satellite coverage is enabled through Rogers Satellite, and in New Zealand, satellite coverage is provided by One NZ. Both Rogers and One NZ have agreements with Starlink provider SpaceX. T-Mobile updated its website to mention satellite roaming last week, and the company says that support for other locations will be coming in the future. T-Mobile is working with global roaming partners and SpaceX to expand T-Satellite. T-Satellite is available to T-Mobile subscribers in the continental U.S., Puerto Rico, Hawaii, and parts of southern Alaska. It is also now available in Canada and New Zealand, with a coverage map available on the T-Mobile website. Rogers and One NZ customers can also use T-Satellite when traveling in the United States as part of the new partnership. T-Mobile's satellite connectivity launched in July 2025 after several months of beta testing, and it is compatible with the iPhone 13 and later. In October 2025, T-Mobile added support for using satellite data with some third-party apps, an option not available with Apple's built-in satellite feature on the iPhone 14 and later. Like Apple's satellite option, T-Satellite kicks in when users do not have a Wi-Fi or cellular connection available. A view of open sky is required to establish connectivity, but there is no need to manually hold an iPhone to the sky to connect as there is with Apple's implementation. T-Satellite works on Apple iPhones, and it can be used alongside the native satellite connectivity. Satellite service is included in T-Mobile's Experience Beyond plans, and is priced at $10 per line for other T-Mobile plans. Smartphone users without T-Mobile service can sign up for T-Satellite for $10 per month.Tag: T-MobileThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:14 pm
iOS 26.5 Brings End-to-End Encryption to iPhone-Android RCS Messages | MacRumors
iOS 26.5 Brings End-to-End Encryption to iPhone-Android RCS Messages
End-to-end encryption (E2EE) for RCS messages between iPhone and Android devices is coming in iOS 26.5, Apple confirmed today. The feature is listed in Apple's iOS 26.5 release notes. Apple says end-to-end encrypted ‌RCS‌ messaging remains in beta even though it is being released in iOS 26.5. The feature is available with supported carriers and will roll out over time, and for conversations to be encrypted, both the receiver and the sender must use a carrier that supports the latest version of ‌RCS‌. End-to-end encryption is on by default, and there is a toggle for it in the Messages section of the Settings app. Encrypted messages are denoted with a small lock symbol. Testing of E2EE for ‌RCS‌ began in iOS 26.4, but Apple did not launch the feature in the iOS 26.4 update. It returned in the iOS 26.5 beta, and has been available throughout the beta testing process. E2EE means that messages sent between devices cannot be intercepted and read by a third party. As of now, ‌RCS‌‌ messages sent between Android and iPhone users do not have E2EE, but iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and watchOS 26.5 will put Android/iPhone conversations on par with iPhone to iPhone conversations that are encrypted through iMessage. Apple worked with the GSM Association to implement E2EE for ‌RCS‌ messages. E2EE is part of the ‌RCS‌ Universal Profile 3.0, published with Apple's help and built on the Messaging Layer Security protocol. ‌‌RCS‌‌ Universal Profile 3.0 also includes editing and deleting messages, cross-platform Tapback support, and replying to specific messages inline during cross-platform conversations.Related Roundups: iOS 26, iPadOS 26Tags: Android, RCSRelated Forum: iOS 26This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:01 pm
iOS 27 Will Let You Create Custom Wallet Passes | MacRumors
iOS 27 Will Let You Create Custom Wallet Passes
Back in April, we highlighted a new add-your-own card Wallet app option coming in iOS 27, and now Bloomberg has shared additional information. At the time, we said Apple was working on a feature that would let users generate digital passes from scans of things like movie tickets, concert passes, and gym membership cards. The option will be called "Create a Pass," and it will bridge the gap between the Wallet app and passes that are not compatible with it. Users will be able to tap on the "+" button in the Wallet app and then scan a QR code on a pass or ticket if one is available. If there is no QR code available, there will be an option to create a custom pass. Text in the app suggests the feature will work for tickets, memberships, gift cards, and more. There are three pass types, each with a different color. Apple is using purple for events, blue for memberships, and orange for other types of passes. Users will be able to customize images, colors and style, and text on the digital passes. The new Wallet option is one of many features coming in ‌iOS 27‌, which will be previewed at Apple's June WWDC event. More information on what to expect from ‌iOS 27‌ can be found in our roundup.Related Roundup: iOS 27Tag: Apple WalletThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:19 pm
Apple Seeds watchOS 26.5, tvOS 26.5 and visionOS 26.5 Release Candidates | MacRumors
Apple Seeds watchOS 26.5, tvOS 26.5 and visionOS 26.5 Release Candidates
Apple today provided developers with the release candidate versions of upcoming watchOS 26.5, tvOS 26.5, and visionOS 26.5 betas for testing purposes. The software comes a week after Apple released the fourth betas for each platform. The software updates are available through the Settings app on each device, and because these are developer betas, a free developer account is required. watchOS 26.5 adds a new Pride watch face to go along with the 2026 Pride Apple Watch band. There's no word on what other features are in the software as of yet. watchOS, tvOS, and visionOS often get few features in each new beta, with updates primarily focusing on bug fixes and performance improvements. Nothing new was found in the betas. watchOS 26.5, visionOS 26.5, and tvOS 26.5 are likely to see a public release next week.Related Roundups: Apple TV, Apple Vision Pro, watchOS 26Buyer's Guide: Apple TV (Don't Buy), Vision Pro (Buy Now)Related Forums: Apple TV and Home Theater, Apple Vision Pro, Apple WatchThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:14 pm
macOS Tahoe 26.5 Release Candidate Now Available | MacRumors
macOS Tahoe 26.5 Release Candidate Now Available
Apple today provided the release candidate version of an upcoming macOS Tahoe 26.5 update to developers for testing purposes, with the update coming a week after Apple seeded the fourth beta. Developers can download the ‌macOS Tahoe‌ 26.5 update by opening up the System Settings app, selecting the General category, and then choosing Software Update. Beta Updates will need to be enabled, and a free developer account is required. No new features were found in the first four ‌macOS Tahoe‌ 26.5 betas, and it's likely the update primarily focuses on bug fixes and performance improvements.Related Roundup: macOS TahoeRelated Forum: macOS TahoeThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:12 pm
Apple Seeds iOS 26.5 and iPadOS 26.5 Release Candidates to Developers | MacRumors
Apple Seeds iOS 26.5 and iPadOS 26.5 Release Candidates to Developers
Apple today seeded the release candidate versions of upcoming iOS 26.5 and iPadOS 26.5 updates to developers for testing purposes, with the software coming a week after Apple released the fourth betas. Registered developers can download the betas from the Settings app on the iPhone or iPad by going to the General section and selecting Software Update. iOS 26.5 and iPadOS 26.5 do not include new Siri capabilities, suggesting any ‌Siri‌ updates are being held until iOS 27. The Maps app has a Suggested Places feature for recommending locations to visit nearby based on trends and recent searches, plus Apple is laying the groundwork for ads in the Apple Maps app. Apple is continuing to test end-to-end encryption (E2EE) for RCS messages between iPhone and Android users. Apple included the feature in the iOS 26.4 beta, but removed it before the update launched to the public. There is a new Pride wallpaper to go along with the Pride Apple Watch band for this year. In the European Union, Apple is testing proximity pairing, notification forwarding, and Live Activities for third-party wearables like earbuds and smartwatches. The functionality will allow third-party wearables to have many of the same features as the Apple Watch and AirPods. More detail on what's new in iOS 26.5 can be found in our iOS 26.5 beta features guide. iOS 26.5 is likely to see a launch next week. Related Roundups: iOS 26, iPadOS 26Related Forum: iOS 26This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »

Older posts

Tuesday May 05
10:00 am
Microsoft 365 Copilot, human agency, and the opportunity for every organization | Office for Mac
Microsoft 365 Copilot, human agency, and the opportunity for every organization
As AI and agents take on more of the execution, people have more agency than ever to unlock their ambition, direct what gets done, and own the outcomes. The post appeared first on Microsoft 365 Blog.
Read more »
10:00 am
Copilot Cowork: From conversation to action across skills, integrations, and devices | Office for Mac
Copilot Cowork: From conversation to action across skills, integrations, and devices
Today, we’re announcing additional capabilities in Cowork to expand on what it can make possible for you. The post appeared first on Microsoft 365 Blog.
Read more »
Friday May 01
03:00 pm
Microsoft Agent 365, now generally available, expands capabilities and integrations | Office for Mac
Microsoft Agent 365, now generally available, expands capabilities and integrations
Microsoft Agent 365 helps you take control of agent sprawl as your control plane to observe, govern, and secure agents and their interactions. The post appeared first on Microsoft 365 Blog.
Read more »
Thursday April 23
12:00 am
Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available | Office for Mac
Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available
From first draft to final polish, Copilot acts as a true collaborator, taking action while you stay in control. The post appeared first on Microsoft 365 Blog.
Read more »
Monday April 13
03:00 pm
Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot | Office for Mac
Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot
Microsoft 365 Copilot can now bring your go-to apps directly into the conversation, which closes the gap between AI-powered insight and real, in-app action. The post appeared first on Microsoft 365 Blog.
Read more »
Wednesday April 01
09:45 pm
New and improved: Multi-agent orchestration, connected experiences, and faster prompt iteration | Office for Mac
New and improved: Multi-agent orchestration, connected experiences, and faster prompt iteration
Learn what’s new in Copilot Studio: Multi-agent systems are now generally available, plus recent updates to the Prompt Editor and governance controls. The post appeared first on Microsoft 365 Blog.
Read more »
Monday March 30
01:00 pm
Copilot Cowork: Now available in Frontier | Office for Mac
Copilot Cowork: Now available in Frontier
Today, Copilot Cowork—designed for long-running, multi-step work in Microsoft 365—is available via the Frontier program. The post appeared first on Microsoft 365 Blog.
Read more »
Wednesday March 25
01:00 pm
New In-App Purchase and subscription data now available in Analytics | ADC Headlines
New In-App Purchase and subscription data now available in Analytics
Analytics in App Store Connect receives its biggest update since its launch, including a refreshed user experience that makes it easier to measure the performance of your apps and games. Updates include: More than 100 new metrics. Now you can access monetization and subscription data in Analytics to better understand the performance of your In-App Purchases and offers. New cohort capabilities. Analyze user behavior based on common attributes — such as download date, download source, offer start date, and more — to measure how a particular group of users performs over time. For example, if you’ve expanded your app to a new region, you can monitor how long it takes users in that region to make a purchase compared to other more established regions. Cohort data is aggregated to ensure user privacy. New peer group benchmarks. Discover how you stack up to peers with two new monetization benchmarks: download-to-paid conversion and proceeds per download. Benchmarks incorporate differential privacy techniques to protect individual developer performance while also providing meaningful and actionable insights. Two new subscription reports. Export these via the Analytics Reports API to perform offline analysis and integrate Analytics into your own data systems. Additional filters. Apply up to seven filters to your selected metrics at once allowing you to drill down further and uncover additional insights. App Store Analytics Guide. This new guide in App Store Connect Help enables you to develop a data-driven strategy and understand App Store tools and features you can use to grow your business. Learn about measuring performance with AnalyticsRead the new Analytics guide
Read more »
Monday March 09
01:00 pm
Powering Frontier Transformation with Copilot and agents | Office for Mac
Powering Frontier Transformation with Copilot and agents
Wave 3 marks a new version of Microsoft 365 Copilot, moving beyond assistance to embedded agentic capabilities. The post appeared first on Microsoft 365 Blog.
Read more »
01:00 pm
Copilot Cowork: A new way of getting work done | Office for Mac
Copilot Cowork: A new way of getting work done
We’re excited to announce Copilot Cowork, the execution layer for Microsoft 365—delegate tasks, coordinate workflows, and stay in control. The post appeared first on Microsoft 365 Blog.
Read more »

Reviews & KoolTools

Unbreakable Style: The Best Hardshell Phone Cases on the Market

Are you looking for the ultimate protection for your smartphone? Hardshell phone cases are the answer. These cases are designed to withstand impact. They keep your phone safe from drops and scratches. In a world full of choices, how do you find the best? We have...

Plugable’s 5-in-1 USB Hub expands your MacBook Pro or MacBook Air’s connection options

The new 5-in-1 USB-C hub from Plugable turns two Mac laptop ports into (as the name implies) five, including Ethernet and more. Designed specifically for MacBook Pro and MacBook Air models, the hub (with the moniker AMS-5IN1E) fits flush against the host Mac and adds...

More Reviews & KoolTools

Community and More

MacTech Events and COVID

Due to the pandemic, the regional MacTech Pro events were pushed into 2021 — as early as reasonably possible. This means at best, early in the third quarter of the year. But depending on guidance and public health, it could be later than that. Once there are details,...

More Community

Software & Services Scanners

Tuesday May 05
04:16 pm
Vulnerability Summary for the Week of April 27, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of April 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info n/a-- OVMS3 3.3.005 Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. 2026-05-01 10 CVE-2026-37541 https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 tendacn[.]com-- W308R Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25316 ExploitDB-44373VulnCheck Advisory: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change tendacn[.]com--W3002R Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers. 2026-04-29 9.8 CVE-2018-25317 ExploitDB-44380VulnCheck Advisory: Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change tendacn[.]com--FH303/A300 Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25318 ExploitDB-44381VulnCheck Advisory: Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change Weaver Network Co., Ltd.--E-office Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC). 2026-04-30 9.8 CVE-2022-50993 https://service.e-office.cn/knowledge/detail/5https://cn-sec.com/archives/1453025.htmlhttps://bbs.chaitin.cn/topic/37https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet synway[.]net-- SMG Gateway Management Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC). 2026-04-30 9.8 CVE-2025-71284 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yamlhttps://mrxn.net/jswz/synway-9-2radius-rce.htmlhttps://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsAhttps://www.synway.net/https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address Directorist Booking--Directorist Booking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2. 2026-04-27 9.3 CVE-2026-22336 https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve Directorist--Directorist Social Login Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4. 2026-04-27 9.8 CVE-2026-22337 https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. 2026-04-27 9.8 CVE-2026-32644 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware n/a--Automotive Grade Linux (AGL) AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently. 2026-05-01 9.8 CVE-2026-37531 https://gerrit.automotivelinux.org/gerrit/src/app-framework-mainhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a-- cannelloni v2.0.0 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. 2026-05-01 9.8 CVE-2026-37539 https://github.com/mguentner/cannellonihttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 Carlson Software--VASCO-B GNSS Receiver The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials. 2026-04-28 9.4 CVE-2026-3893 https://www.carlsonsw.com/support-and-training/https://www.cve.org/CVERecord?id=CVE-2026-3893https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json Mersenne--Prime95 Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands. 2026-04-29 8.4 CVE-2018-25299 ExploitDB-44649Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH xataboost--XATABoost CMS XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information. 2026-04-29 8.2 CVE-2018-25300 ExploitDB-44622Official Product HomepageVulnCheck Advisory: XATABoost CMS 1.0.0 SQL Injection via news.php Easy MPEG--Easy MPEG to DVD Burner Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe. 2026-04-29 8.4 CVE-2018-25301 ExploitDB-44565Product ReferenceVulnCheck Advisory: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow Alloksoft--Allok Video to DVD Burner Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution. 2026-04-29 8.4 CVE-2018-25303 ExploitDB-44518Official Product HomepageVulnCheck Advisory: Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH Filehippo--Free Download Manager Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code. 2026-04-29 8.4 CVE-2018-25304 ExploitDB-44499Product ReferenceVulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH Sysgauge--SysGauge Pro SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges. 2026-04-29 8.4 CVE-2018-25307 ExploitDB-44455VulnCheck Advisory: SysGauge Pro 4.6.12 Local Buffer Overflow SEH donmik--Buddypress Xprofile Custom Fields Type BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. 2026-04-29 8.8 CVE-2018-25308 ExploitDB-44432Official Product HomepageVulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution Alloksoft--WMV to AVI MPEG DVD WMV Converter Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious input containing shellcode with structured exception handler (SEH) overwrite to bypass protections and execute code with application privileges. 2026-04-29 8.4 CVE-2018-25314 ExploitDB-44365Official Product HomepageProduct ReferenceVulnCheck Advisory: Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow Alloksoft--Video Joiner Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with structured exception handler (SEH) overwrite and shellcode to achieve code execution when the application processes the license registration input. 2026-04-29 8.4 CVE-2018-25315 ExploitDB-44364Official Product HomepageProduct ReferenceVulnCheck Advisory: Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name marketingfire--Widget Options Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0. 2026-05-02 8.8 CVE-2026-2052 https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cvehttps://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534https://plugins.trac.wordpress.org/changeset/3481338/https://plugins.trac.wordpress.org/changeset/3514411/ Milesight--MS-Cxx63-PD An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. 2026-04-27 8.8 CVE-2026-20766 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware wclovers--WCFM Frontend Manager for WooCommerce The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. 2026-05-02 8.1 CVE-2026-2554 https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cvehttps://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386https://plugins.trac.wordpress.org/changeset/3483695/ opencats--OpenCATS OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete. 2026-04-28 8.1 CVE-2026-27760 https://chocapikk.com/posts/2026/opencats-installer-rce/https://github.com/opencats/OpenCATS/pull/706https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. 2026-04-27 8.8 CVE-2026-27785 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware Cockpit--Cockpit CMS Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server. 2026-04-29 8.8 CVE-2026-34965 https://github.com/agentejo/cockpithttps://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections n/a--(UDS) & OBD-II (On Board Diagnostics for Vehicles) miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. 2026-05-01 8.8 CVE-2026-37536 https://github.com/miaofng/uds-chttps://github.com/openxc/uds-chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a--Open-SAE-J1939 (Daniel Martensson) collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt- >data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. 2026-05-01 8.1 CVE-2026-37537 https://github.com/DanielMartensson/Open-SAE-J1939https://github.com/collin80/Open-SAE-J1939https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 openampproject[.]org--OpenAMP v2025.10.0 OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. 2026-05-01 8.4 CVE-2026-37540 https://github.com/OpenAMP/open-amphttps://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a--MixPHP Framework 2.x Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to OpisClosureunserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution. 2026-05-01 8.4 CVE-2026-37552 https://github.com/mix-php/mixhttps://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phphttps://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 benjaminprojas--WP Editor The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. 2026-05-01 8.8 CVE-2026-3772 https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cvehttps://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103https://plugins.trac.wordpress.org/changeset/3480577/ chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0. 2026-04-30 8.1 CVE-2026-40600 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xmhttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 TRENDnet--TEW-821DAP A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer. 2026-05-02 8.8 CVE-2026-7607 VDB-360564 | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowVDB-360564 | CTI Indicators (IOB, IOC, IOA)Submit #806214 | Trendnet TEW-821DAP v1.12B01 CWE-120 Buffer Copy without Checking Size of Inputhttps://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_BO.md carazo--Import and export users and customers The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page. 2026-05-02 8.8 CVE-2026-7641 https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cvehttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21https://plugins.trac.wordpress.org/changeset/3515646 Cozmoslabs--Profile Builder Pro The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory. 2026-05-02 8.1 CVE-2026-7647 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L13https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L13 Shenzhen Libituo Technology--LBT-T300-HW1 A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 8.8 CVE-2026-7674 VDB-360827 | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowVDB-360827 | CTI Indicators (IOB, IOC, IOA)Submit #800705 | Libtor Technology lbt-t300-hw1 closure, xreq). The NULL propagation chain through afb-context.c:110 (context- >credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context- >credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14. 2026-05-01 7.8 CVE-2026-37525 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) afb-daemon v19.90.0 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29. 2026-05-01 7.8 CVE-2026-37526 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) aglservice v17.1.12 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer. 2026-05-01 7.1 CVE-2026-37532 https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-levelhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) isotp-c openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information. 2026-05-01 7.1 CVE-2026-37535 https://github.com/openxc/isotp-chttps://github.com/openxc/isotp-c/blob/master/src/isotp/receive.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a-- Vanetza V2X v26.02 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver. 2026-05-01 7.5 CVE-2026-37554 https://github.com/riebl/vanetzahttps://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpphttps://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpphttps://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40595 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4060 https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1767https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1785https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/ chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40601 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-cpr6-mhgm-893whttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb- >prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings. 2026-05-02 7.5 CVE-2026-4061 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1748https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Hooks/SearchResults.php#L39https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Search.php#L152https://plugins.trac.wordpress.org/changeset/3503627/ cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context - `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4062 https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/ n/a--libssh2 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. 2026-05-01 7.3 CVE-2026-7598 VDB-360555 | libssh2 userauth.c userauth_password integer overflowVDB-360555 | CTI Indicators (IOB, IOC, IOA)Submit #805564 | libssh2 Shell interface, gaining root-level access to the device. 2026-04-29 4.3 CVE-2018-25310 ExploitDB-44387Vulnerability AdvisoryVulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution gnu--wget2 wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. 2026-04-29 4.8 CVE-2026-1858 https://www.tenable.com/security/research/tra-2026-37 wazuh--wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4. 2026-04-29 4.4 CVE-2026-26204 https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857https://github.com/wazuh/wazuh/releases/tag/v4.14.4 Oracle Corporation--Oracle Linux An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context. 2026-05-01 4.4 CVE-2026-35233 Oracle Advisory n/a-- V2Board v1.7.4 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis. 2026-05-01 4.9 CVE-2026-37505 https://github.com/v2board/v2boardhttps://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 nextlevelbuilder--ui-ux-pro-max-skill A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet. 2026-05-01 4.3 CVE-2026-7596 VDB-360549 | nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingVDB-360549 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805510 | nextlevelbuilder ui-ux-pro-max-skill 2.5.0 Slide Generator Multiple Stored XSShttps://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/ n/a--Open5GS A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component. 2026-05-02 4.3 CVE-2026-7601 VDB-360558 | Open5GS AMF gmm-handler.c denial of serviceVDB-360558 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805675 | Open5GS v.2.7.6 Denial of Servicehttps://github.com/open5gs/open5gs/issues/4321https://github.com/open5gs/open5gs/commit/ebc66942b6f8f1fab2d640e71cf4e9f1a423b426https://github.com/open5gs/open5gs/releases/tag/v2.7.7https://github.com/open5gs/open5gs/ itsourcecode--Courier Management System A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. 2026-05-02 4.7 CVE-2026-7612 VDB-360569 | itsourcecode Courier Management System edit_user.php sql injectionVDB-360569 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #806275 | itsourcecode Courier Management System V1.0 SQL Injectionhttps://github.com/ltranquility/submit/issues/12https://itsourcecode.com/ ChatGPTNextWeb--NextChat A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-02 4.3 CVE-2026-7643 VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyVDB-360755 | CTI Indicators (IOB, IOC, IOA)Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policyhttps://github.com/ChatGPTNextWeb/NextChat/issues/6756https://github.com/ChatGPTNextWeb/NextChat/ n/a--crmeb_java A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7673 VDB-360826 | crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadVDB-360826 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800684 | crmeb crmeb_java 1.3.4 Unrestricted Uploadhttps://fx4tqqfvdw4.feishu.cn/docx/EgMOdHyq6oyxhux5vpJcr5cgnAf?from=from_copylink kerwincui--FastBee A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7676 VDB-360829 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalVDB-360829 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800723 | kerwincui FastBee ≤ 1.2.1 Path Traversalhttps://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink jsbroks--COCO Annotator A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7680 VDB-360833 | jsbroks COCO Annotator Data Endpoint datasets.py path traversalVDB-360833 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #801150 | jsbroks COCO Annotator 0.11.1 Absolute Path Traversalhttps://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter AMTT--Hotel Broadband Operation System A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7697 VDB-360866 | AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionVDB-360866 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #803272 | Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System v1.0 SQL Injectionhttps://github.com/testnet0/testnet/issues/74 Telegram--Desktop A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7701 VDB-360870 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceVDB-360870 | CTI Indicators (IOB, IOC, IOA)Submit #804341 | Telegram Telegram Desktop
Read more »
Thursday April 30
02:04 pm
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs | Krebs on Security
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.
Read more »
Monday April 27
04:22 pm
Vulnerability Summary for the Week of April 20, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow 94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001 OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763 HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605 IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907 hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/ Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95 Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0 Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech Back to top
Read more »
Tuesday April 21
02:53 pm
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty | Krebs on Security
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.
Read more »
Thursday April 16
03:28 pm
Most secure browser for Mac in 2026 | Intego Mac Security
Most secure browser for Mac in 2026
For most Mac users, your browser is where a lot of online life happens — reading emails, logging into accounts, using web apps, shopping, and banking. It’s also where a small mistake can lead to a bigger problem, whether that means downloading something that looked harmless or signing into a phishing page that seemed real […] The post appeared first on The Mac Security Blog.
Read more »
Tuesday April 14
09:47 pm
Patch Tuesday, April 2026 Edition | Krebs on Security
Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.
Read more »
Friday April 10
05:13 pm
Why more Mac attacks now rely on social engineering | Intego Mac Security
Why more Mac attacks now rely on social engineering
Recent security findings suggest a change in how Mac users are being targeted. Instead of searching for technical gaps in software, attackers are finding ways to ask users to run commands themselves. This pattern shows up across different reports, from fake apps that look legitimate to scam pages that guide users into pasting commands into […] The post appeared first on The Mac Security Blog.
Read more »
Tuesday April 07
07:01 pm
The new Intego Antivirus is here — everything you need to know about Intego ONE | Intego Mac Security
The new Intego Antivirus is here — everything you need to know about Intego ONE
Intego ONE is Intego’s new all-in-one Mac security app, built to make protection easier to manage in one place. Instead of juggling separate tools, you get antivirus protection, firewall protection, SmartClean, and VPN in one Mac-focused app, depending on your plan. If you’ve used Intego products before, the shift is straightforward — fewer moving parts […] The post appeared first on The Mac Security Blog.
Read more »
05:02 pm
Russia Hacked Routers to Steal Microsoft Office Tokens | Krebs on Security
Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
Read more »
01:59 pm
The ultimate guide to Mac security | Intego Mac Security
The ultimate guide to Mac security
Macs have a strong security foundation. That’s true — and it’s worth appreciating. But “safer than” doesn’t mean “safe from.” Modern Mac threats don’t always look like the classic virus people imagine. A lot of today’s attacks rely on social engineering, fake installers, stolen credentials, and the simple reality that people download things, click prompts, […] The post appeared first on The Mac Security Blog.
Read more »
Monday April 06
07:22 am
How to Choose the Right iPhone (2026): A Simple Guide | Intego Mac Security
How to Choose the Right iPhone (2026): A Simple Guide
While the latest iPhone is the best and fastest model every year, you might not need its features. Apple sells several iPhone models; here's how to choose the right iPhone for your needs. The post appeared first on The Mac Security Blog.
Read more »

Older posts

Tuesday March 24
02:59 pm
Introducing Apple Business — a new all-in-one platform for businesses of all sizes | Apple Newsroom
Introducing Apple Business — a new all-in-one platform for businesses of all sizes
Apple today announced Apple Business, a new all-in-one platform that allows companies to manage devices and reach more customers.
Read more »

Wednesday May 06
01:18 am
Workers API Issue | CloudFlare
Workers API Issue
May 6, 01:18 UTCMonitoring - A fix has been implemented and we are monitoring the results.May 6, 01:08 UTCInvestigating - Cloudflare is investigating Worker API failures. Customers might experience an error using the Worker API. Workers that are already running in production are not affected. More updates to follow shortly.
Read more »
Tuesday May 05
11:45 pm
Search experience and subreddit experience is degraded | Reddit
Search experience and subreddit experience is degraded
May 5, 16:45 PDTIdentified - We have identified the issue and a fix is being implemented.May 5, 16:44 PDTInvestigating - We are currently investigating an issue which has caused bad search and subreddit feed experience
Read more »
11:35 pm
UPDATE: **Summary** Investigating elevated error rates with Gemini conversations. **Description** Mitigation work is currently underway by our engineering team. We do not have an ETA for mitigation at this point. We will provide more information by Tuesday, 2026-05-05 20:30 PDT. **Symptoms** Affected customers are experiencing “Something went wrong(13)” error message in their Gemini conversations. **Workaround** None at this time. | Google Apps
UPDATE: **Summary** Investigating elevated error rates with Gemini conversations. **Description** Mitigation work is currently underway by our engineering team. We do not have an ETA for mitigation at this point. We will provide more information by Tuesday, 2026-05-05 20:30 PDT. **Symptoms** Affected customers are experiencing “Something went wrong(13)” error message in their Gemini conversations. **Workaround** None at this time.
Incident began at 2026-05-04 16:40 (times are in Coordinated Universal Time (UTC)).Summary Investigating elevated error rates with Gemini conversations. Description Mitigation work is currently underway by our engineering team. We do not have an ETA for mitigation at this point. We will provide more information by Tuesday, 2026-05-05 20:30 PDT. Symptoms Affected customers are experiencing "Something went wrong(13)" error message in their Gemini conversations. Workaround None at this time. Affected products: Gemini
Read more »
10:49 pm
Session initialization failed error when trying to connect apps | Zapier
Session initialization failed error when trying to connect apps
Status: InvestigatingWe are currently investigating an issue where users receive "Session initialization failed" errors when attempting to connect apps in Zapier.
Read more »
09:45 pm
Errors related to Klaviyo app integration | Zapier
Errors related to Klaviyo app integration
Status: MonitoringWe are continuing to monitor the service disruption related to Klaviyo: https://status.klaviyo.com/incidents/yyh7s59brj67 If you are experiencing issues with this app integration, you can reach out to our team at: https://zapier.com/app/get-help
Read more »
09:20 pm
Resolution Issues for .de Domains | CloudFlare
Resolution Issues for .de Domains
May 5, 21:20 UTCIdentified - The issue has been identified and a fix is being implemented.May 5, 21:17 UTCInvestigating - We are observing issues with authoritative resolution for the .de TLD.
Read more »
08:58 pm
Incoming webhooks — some requests not processed (encoding in Content-Type) | Zapier
Incoming webhooks — some requests not processed (encoding in Content-Type)
Status: MonitoringBetween April 26, 2026, 7:14 PM UTC and April 30, 2026, 4:36 AM UTC, a subset of incoming webhooks to Zapier were not processed during ingestion. Webhooks sent with a Content-Type header that specified a non-UTF-8 character set in the way below were rejected instead of being delivered to your Zaps: Content-Type: application/x-www-form-urlencoded; charset=iso-8859-1 Webhooks using typical UTF-8 Content-Type values were not affected by this issue. If your upstream system sent webhooks matching the pattern above during that time window, those individual events did not trigger your Zaps. Other triggers and webhook formats continued to work as usual. For any specific events that occurred while your app was sending webhooks in that format during the window above, you will need to resend the webhook from the upstream application (for example, by having that app fire the event again or resubmit the payload), so that Zapier receives a new request. Replaying a past run in Zapier does not replace a missing inbound webhook from your app. If you are unsure whether your integration uses that header, check your server or integration configuration for charset=iso-8859-1 (or other non-UTF-8 charset) on application/x-www-form-urlencoded requests to your Zap’s webhook URL.
Read more »
07:53 pm
CPT (Cape Town) on 2026-05-05 | CloudFlare
CPT (Cape Town) on 2026-05-05
THIS IS A SCHEDULED EVENT May 5, 22:00 - 23:00 UTCMay 5, 19:23 UTCScheduled - We will be performing scheduled maintenance in CPT (Cape Town) datacenter on 2026-05-05 between 22:00 and 23:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
05:53 pm
PHL (Philadelphia) on 2026-05-06 | CloudFlare
PHL (Philadelphia) on 2026-05-06
THIS IS A SCHEDULED EVENT May 6, 03:00 - 03:45 UTCMay 5, 17:43 UTCScheduled - We will be performing scheduled maintenance in PHL (Philadelphia) datacenter on 2026-05-06 between 03:00 and 03:45 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
05:19 pm
Delayed Network Analytics and Alerting | CloudFlare
Delayed Network Analytics and Alerting
May 5, 17:19 UTCInvestigating - We are currently experiencing a delay in processing network analytics across our L4 DDoS protection products. There is no impact to DDoS mitigation functionality; however, customers may notice a lag in the population of Network Analytics dashboards. This delay also affects the delivery of real-time alerts for these products. We are working to resolve the issue and will provide further updates as they become available.
Read more »
04:49 pm
Issues with new Cloudflare Tunnel connections and Browser Isolation registrations | CloudFlare
Issues with new Cloudflare Tunnel connections and Browser Isolation registrations
May 5, 16:49 UTCInvestigating - Cloudflare is investigating connectivity issues affecting Cloudflare Tunnel and Browser Isolation. This issue is currently limited to the establishment of new connections. Customers may experience errors or timeouts when attempting to register new tunnels via cloudflared or when initiating new Browser Isolation sessions. Existing tunnels and active sessions are not affected and continue to operate normally. Our engineering team is actively investigating the root cause, and we will provide additional updates as soon as more information is available.
Read more »
03:24 pm
Slower build start time in Workers Builds | CloudFlare
Slower build start time in Workers Builds
May 5, 15:24 UTCInvestigating - Some Workers Builds users may experience increased build dequeue times
Read more »
11:33 am
Errors adding R2 custom domains | CloudFlare
Errors adding R2 custom domains
May 5, 11:33 UTCInvestigating - Cloudflare is aware of and investigating an issue with adding R2 custom domains which potentially impacts multiple customers. This does not impact serving or uploading R2 objects.We are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »
08:04 am
Bot Management Issues | CloudFlare
Bot Management Issues
May 5, 08:04 UTCInvestigating - Cloudflare is investigating issues with our Bot Management feature. Customers may experience an unexpected increase in Bot Management rules matching detection IDs 50331648 and 50331649.We are working to mitigate this problem. More updates to follow shortly.
Read more »
05:51 am
Network Performance Issues in Ashburn | CloudFlare
Network Performance Issues in Ashburn
May 5, 05:51 UTCUpdate - This incident affects a subset of Cloudflare Network Interconnects (CNI) 2.0 only.May 5, 05:44 UTCIdentified - The issue has been identified and a fix is being implemented.May 5, 05:38 UTCInvestigating - Cloudflare is investigating issues with network performance in Ashburn.We are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »
03:00 am
Durable Objects startup errors in Eastern North America (ENAM) region | CloudFlare
Durable Objects startup errors in Eastern North America (ENAM) region
May 5, 03:00 UTCResolved - Between 03:15:50 and 03:21:06 UTC, we experienced a brief period of startup errors affecting Durable Objects and D1 databases within the Eastern North America (ENAM) region.
Read more »
Monday May 04
10:00 pm
Network hardware failure in Hong Kong | CloudFlare
Network hardware failure in Hong Kong
May 4, 22:00 UTCInvestigating - Reduced redundancy due to network hardware failure in Hong Kong
Read more »
08:20 pm
Increased build dequeue duration in Workers Builds | CloudFlare
Increased build dequeue duration in Workers Builds
May 4, 20:20 UTCInvestigating - Some Workers Builds users may experience increased build dequeue times, or builds that are stuck in a queued state indefinitely.
Read more »
07:08 pm
Maintenance: Scheduled platform upgrade | Zapier
Maintenance: Scheduled platform upgrade
Status: ScheduledWe will perform a routine framework upgrade to keep the Zapier platform secure and up to date. No downtime is expected. You may notice brief disruption while trying to log in to Zapier for up to a minute. Affected components Login (Under maintenance)
Read more »
05:22 pm
YUL (Montréal) on 2026-05-06 | CloudFlare
YUL (Montréal) on 2026-05-06
THIS IS A SCHEDULED EVENT May 6, 08:00 - 12:00 UTCMay 4, 17:18 UTCScheduled - We will be performing scheduled maintenance in YUL (Montréal) datacenter on 2026-05-06 between 08:00 and 12:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »

Older posts

Showcase

Kool Tools: Pegasus3 Symply Edition

Promise Technology and Symply have launched the Pegasus3 Symply Edition, the next generation of the Pegasus desktop RAID storage system. The new system combines 40 Gb/s Thunderbolt 3 performance with Symply's storage management suite. The Pegasus3 Symply Edition is a...

Kool Tools: TimeCache

The Rolling Stones told us that time was on our side (or at least Mick Jagger's side). That's not always true, but with TimeCache (http://www.pandaware.com/timecache/index.html) for Mac OS X from PandaWare we can at least keep track of it. With TimeCache -- now...

Kool Tools: PDF Editor for Mac

Editing PDF files on Mac OS X can be tough, but a product from AnyBizSoft, a Wondershare company focused on PDF solutions, simplifies the process. PDF Editor for Mac, integrates AnyBizSoft's existing PDF to Word conversion technology. It not only enables users to edit...

Kool Tools: Aunsoft’s Video Converter for the Mac

Aunsoft Video Converter for Mac (http://www.aunsoft.com/video-converter-mac/) is a US$35 Mac video converting tool you can use to convert just about any type of video for use on a variety of Apple devices. What's more, it also boasts a several editing features. This...

More Showcase

Scanners “By The Numbers”

Monday May 04
03:35 pm
iPad Deals Hit Walmart — $50+ Off Apple’s Entry-Level Models | MacPrices.net
iPad Deals Hit Walmart — $50+ Off Apple’s Entry-Level Models
Walmart is now offering $50–$52 off Apple’s iPad lineup, bringing prices below Apple’s standard MSRP and making these models a bit more approachable right now. The base 11-inch iPad that typically sells for about $349 is now $299, which is one of the best consistent discounts we’ve seen on these newer models. Check current iPad deals at Walmart. Walmart also makes the buying process simple, with fast free shipping on online orders and the option for free local store pickup (if available in your area). That combination of price and convenience is what really stands out right now.For the latest sales and deals, see our iPad Price Tracker, updated daily.
Read more »
01:29 pm
MacBook Neo Now In Stock at Walmart — Fast Shipping & Easy Pickup Available | MacPrices.net
MacBook Neo Now In Stock at Walmart — Fast Shipping & Easy Pickup Available
The MacBook Neo is now fully in stock at Walmart’s online store, making it one of the easiest places right now to actually buy one without worrying about availability. Instead of hunting for specific configurations, you can go in, choose what you want, and check out without the usual friction. Check current MacBook Neo availability at Walmart.Walmart also makes the process simple once you decide—offering fast free shipping on online orders, along with the option for free local store pickup (if available in your area). That combination of full availability and easy fulfillment is what really stands out right now.For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.
Read more »
01:09 pm
13″ M5 MacBook Air Drops $150 at Amazon — Lowest Prices Across the Lineup | MacPrices.net
13″ M5 MacBook Air Drops $150 at Amazon — Lowest Prices Across the Lineup
13-inch M5 MacBook Air pricing has finally shifted, with Amazon now offering $150 off across the entire lineup. The popular 16GB/512GB model has dropped to about $949 from Apple’s $1099 MSRP, and higher-end configurations are seeing the same consistent discount pattern. Check current 13-inch deals at Amazon. The 16GB/1TB model is now around $1149 (down from $1299), while the 24GB/1TB version is about $1349 (down from $1499), giving you the same $150 savings no matter which configuration you choose. Browse all configurations here. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.
Read more »
12:34 pm
15″ M5 MacBook Air Drops $150 at Amazon & B&H — Lowest Prices Yet | MacPrices.net
15″ M5 MacBook Air Drops $150 at Amazon & B&H — Lowest Prices Yet
Amazon and B&H are now offering some of the best pricing yet on Apple’s 15-inch M5 MacBook Air lineup, with $150 discounts across multiple configurations. The popular 16GB/512GB model has dropped to about $1149 from Apple’s $1299 MSRP, and similar savings are showing up on higher storage and memory options as well. Check current deals at Amazon. B&H is matching these prices while adding a key advantage: free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. View current deals at B&H. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.
Read more »
Thursday April 30
01:49 pm
Compare MacBook Neo prices instantly across retailers with our easy price tracker—see deals, stock status, and savings at a glance. | MacPrices.net
Compare MacBook Neo prices instantly across retailers with our easy price tracker—see deals, stock status, and savings at a glance.
Our exclusive MacBook Neo Price Tracker makes it incredibly easy to see exactly where to find the best deal—without wasting time jumping between retailer sites. Instead of digging through multiple tabs, everything is right there in one simple, clean table. You can instantly compare prices across Apple’s major retailers and see which store is offering the lowest price at any given moment. Even better, the tracker shows current sale prices side-by-side with Apple’s MSRP, so you know exactly how much you’re saving. One of the most useful features is the at-a-glance stock status. A quick glance tells you which retailers actually have the MacBook Neo available for delivery within a reasonable timeframe, helping you avoid the frustration of clicking through to an out-of-stock product page. And because deals change fast, the page is designed for speed and simplicity—prices are visible immediately above the fold, making it easy to check for updates anytime you visit.
Read more »
Wednesday April 29
08:16 pm
Best iPad Air Deals Right Now — Up to $100 Off M4 Models at Amazon | MacPrices.net
Best iPad Air Deals Right Now — Up to $100 Off M4 Models at Amazon
Amazon’s iPad Air discounts are strongest on the higher-storage models right now, with the 13-inch 1TB configuration showing the biggest savings at $100 off Apple’s MSRP. The 11-inch models are also seeing useful discounts, especially if you want a lighter tablet at a lower starting price. Check Amazon’s 11-inch iPad Air deals here. If you want the larger display, Amazon’s 13-inch iPad Air deals are where the biggest dollar savings show up, with several configurations priced well below Apple’s standard pricing. Shop Amazon’s 13-inch iPad Air deals here. For the latest sales and deals, see our iPad Air Price Tracker, updated daily.
Read more »
01:34 pm
16″ M5 Pro MacBook Pro Deals Hit Amazon — Up to $200 Off Key Configs | MacPrices.net
16″ M5 Pro MacBook Pro Deals Hit Amazon — Up to $200 Off Key Configs
Amazon is starting to roll out more meaningful discounts on Apple’s 16-inch M5 Pro MacBook Pro lineup, with select configurations now seeing price cuts of up to $200. The 24GB/1TB model is currently $150 off, while the higher-end 48GB/1TB version is seeing a full $200 discount—bringing both models below their usual pricing for the first time. These are the kinds of early deals that signal broader price movement across the lineup, especially for higher-memory configurations. You can check current deals here: 24GB/1TB model and 48GB/1TB model. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.
Read more »
Tuesday April 28
10:43 pm
16″ M5 Max MacBook Pros $200 off at B&H — Fast Free Shipping Included | MacPrices.net
16″ M5 Max MacBook Pros $200 off at B&H — Fast Free Shipping Included
B&H Photo is now offering $200 off Apple’s 16-inch M5 Max MacBook Pro lineup, bringing prices down across multiple high-end configurations. With Apple’s MSRP starting around $3899 for these models, that discount is one of the first meaningful price drops we’ve seen so far. What makes this deal stand out even more is B&H’s free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. You can check current configurations here at B&H Photo. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.
Read more »
08:31 pm
Metro by T-Mobile Drops iPhone 17e to $349 — $250 Off with Port-In | MacPrices.net
Metro by T-Mobile Drops iPhone 17e to $349 — $250 Off with Port-In
Metro by T-Mobile is currently offering one of the more straightforward iPhone deals out there, knocking $250 off the iPhone 17e and bringing the price down to $349.99 with an instant discount at checkout. There’s no complicated bill credit structure here—you just need to bring your number, sign up for a qualifying plan, and pay your first month of service. Plans start at $55 for the first month and drop to $50 with AutoPay. You can check the deal here: Metro by T-Mobile. For the latest sales and deals, see our iPhone Price Tracker, updated daily.
Read more »
Monday April 27
03:45 pm
MacBook Neo Now Fully In Stock at Walmart — Easy Ordering & Pickup Available | MacPrices.net
MacBook Neo Now Fully In Stock at Walmart — Easy Ordering & Pickup Available
MacBook Neo availability at Walmart has shifted in a big way—every configuration is now in stock and ready to order. Instead of scattered availability, buyers can now choose from the full lineup with confidence, whether ordering online for free shipping or selecting local store pickup where available. This makes Walmart one of the easiest places right now to actually get a MacBook Neo without worrying about inventory gaps. If you’ve been waiting for wider availability, this is a much smoother buying window. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.
Read more »
02:53 pm
AirPods Deals Compared: Amazon vs Walmart vs Apple Pricing Right Now | MacPrices.net
AirPods Deals Compared: Amazon vs Walmart vs Apple Pricing Right Now
AirPods deals are lining up across Amazon and Walmart, and for once it’s easy to compare real savings across the lineup. The base AirPods 4 are down to about $99 (vs $129 MSRP), while AirPods Pro 3 models are holding around $199 compared to Apple’s $249 price. Walmart often matches or slightly undercuts Amazon—and adds the option for local pickup or fast shipping. You can check current deals here: AirPods at Amazon and AirPods at Walmart. For the latest sales and deals, see our AirPods Price Tracker, updated daily.
Read more »
Saturday April 25
08:21 am
14″ M5 Pro MacBook Pro Deals Expand — Amazon Discounts All Configurations | MacPrices.net
14″ M5 Pro MacBook Pro Deals Expand — Amazon Discounts All Configurations
The 14-inch M5 Pro MacBook Pro lineup is finally starting to see broader discounts, and this time it’s not just one or two configurations. Amazon is now offering deals across all eight configurations, from base 16GB/512GB models to higher-end memory and storage options. These early discounts, ranging up to $237 off MSRP, are typically the first sign that pricing is beginning to shift away from launch levels. If you’ve been waiting for a deal on a 14″ M5 Pro, this is the first moment where the entire lineup becomes worth a closer look. View deals here at Amazon. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »

Older posts

Tuesday May 05
09:41 pm
Apple 11″ M4 128GB WiFi iPad Air (2026) for $520 + free shipping | DealNews iPads
Apple 11″ M4 128GB WiFi iPad Air (2026) for $520 + free shipping
Get this new release from Apple at its best price across all four colors. 256GB is likewise discounted. Shipping is free. Buy Now at Amazon
Read more »
02:42 pm
Refurb Unlocked Apple iPad Pro 3 11″ 128GB WiFi + Cellular Tablet (2021) for $409 + free shipping | DealNews iPads
Refurb Unlocked Apple iPad Pro 3 11″ 128GB WiFi + Cellular Tablet (2021) for $409 + free shipping
You'd pay over $500 elsewhere for a refurb model. A 1-year Allstate warranty applies. Buy Now at eBay
Read more »
02:24 pm
Refurb Apple MacBook Pro i7 13″ Laptop (2019) for $358 + free shipping | DealNews Laptops
Refurb Apple MacBook Pro i7 13″ Laptop (2019) for $358 + free shipping
That's 60% off at a savings of $540. A 1-year Allstate warranty applies. Buy Now at eBay
Read more »
Monday May 04
09:48 pm
Unlocked Apple iPad Air M3 13″ 256GB WiFi + Cellular Tablet (2025) for $749 + free shipping | DealNews iPads
Unlocked Apple iPad Air M3 13″ 256GB WiFi + Cellular Tablet (2025) for $749 + free shipping
Get this Apple iPad at Best Buy for $749, a $300 savings. Most merchants only sell refurbs for this model. Shipping is free. Deal ends May 5th at 1:00am ET. Buy Now at Best Buy
Read more »
03:08 pm
Refurb Apple MacBook Pro M2 Pro 14.2″ Laptop (2023) for $865 + free shipping | DealNews Laptops
Refurb Apple MacBook Pro M2 Pro 14.2″ Laptop (2023) for $865 + free shipping
At eBay, get the refurb Apple MacBook Pro M2 Pro 14.2″ Laptop for $865. It’s the best deal we’ve seen for this model in any condition. It includes a 1-year Allstate warranty. Buy Now at eBay Features Apple M2 Pro Chip 14.2″ Liquid Retina XDR display 16GB RAM and 512GB SSD Mac OS Model: MPHE3LL/A
Read more »
Saturday May 02
10:58 am
Refurb Apple 7th-Gen. iPad 10.2″ 32GB WiFi Tablet (2019) for $90 + free shipping | DealNews iPads
Refurb Apple 7th-Gen. iPad 10.2″ 32GB WiFi Tablet (2019) for $90 + free shipping
This refurbished 7th-generation Apple iPad is now just $90 at Walmart. That's another $9 drop since our January mention and the best deal we've ever seen for this 2019 release. You'd pay over $100 for a refurbished item today at Amazon. Warranty info isn't available on the product page. Buy Now at Walmart
Read more »
09:19 am
Refurb Scratch & Dent Apple iPad Deals at Woot for From $80, iPad Air from $230 + free shipping w/ Prime | DealNews iPads
Refurb Scratch & Dent Apple iPad Deals at Woot for From $80, iPad Air from $230 + free shipping w/ Prime
This iPad sale at Woot has dropped the prices on a range of scratch-and-dent Apple iPads. It puts the price of standard iPads at $80, iPad Mini models at $210, and iPad Air tablets at $230. You can shop multiple generations of Apple tablets, from the budget-friendly iPad 6 to more recent releases like the 2022 iPad 10 and iPad Air 5. Amazon Prime members get free shipping on all orders, too. The sale ends on May 15, 2026. Buy Now at Woot! An Amazon Company
Read more »
Friday May 01
12:00 pm
Apple iPad Magic Keyboard Case for iPad Pro 13″ for $263 + free shipping | DealNews Accessories
Apple iPad Magic Keyboard Case for iPad Pro 13″ for $263 + free shipping
Amazon offers the Apple iPad Magic Keyboard Case for iPad Pro 13″ for $263. That’s the lowest price it’s been listed at since Black Friday and $16 less than what you’d pay elsewhere. Shipping is free. Buy Now at Amazon
Read more »
11:18 am
Refurb Apple Mac Mini M2 Pro Desktop for $1,729 + free shipping | DealNews Laptops
Refurb Apple Mac Mini M2 Pro Desktop for $1,729 + free shipping
That's $170 less than a new model costs. A 1-year Allstate warranty applies. Buy Now at eBay Features Apple M2 Pro Chip with 10‑core CPU 16GB RAM and 1TB SSD macOS
Read more »
Thursday April 30
08:51 pm
Refurb Apple MacBook Air Broadwell i5 11.6″ Laptop (2015) for $150 + free shipping | DealNews Laptops
Refurb Apple MacBook Air Broadwell i5 11.6″ Laptop (2015) for $150 + free shipping
That's 90% off its original list price and the lowest price we could find for this refurb. A 90-day warranty and free shipping apply. Buy Now at UntilGone
Read more »
01:51 pm
Apple MacBook Air M5 15.3″ Laptop (2026) w/ 24GB RAM for $1,299 + free shipping | DealNews Laptops
Apple MacBook Air M5 15.3″ Laptop (2026) w/ 24GB RAM for $1,299 + free shipping
That’s a total savings of $220 off. It’s even a bit lower than the best we could find on a 13.6″ model. Shipping is free. Buy Now at B&H Photo Video Features 15.3″ 2560×1664 display Apple M5 CPU 24GB RAM Mac OS
Read more »
10:40 am
Refurb Unlocked 5th-Gen. Apple iPad Air 5 256GB WiFi+ Cellular 10.9″ Tablet for $340 + free shipping | DealNews iPads
Refurb Unlocked 5th-Gen. Apple iPad Air 5 256GB WiFi+ Cellular 10.9″ Tablet for $340 + free shipping
That's a huge savings of $409. A 1-year Allstate warranty applies. Buy Now at eBay
Read more »
08:22 am
Apple 13″ M5 MacBook Air (2026) for $1,350 + free shipping | DealNews Laptops
Apple 13″ M5 MacBook Air (2026) for $1,350 + free shipping
Amazon offers the Apple 13.6″ M5 MacBook Air (2026) for $1,350. Just released this March, it’s $149 off and the lowest price we’ve seen for it thus far. Shipping is free. Buy Now at Amazon Features 13.6″ 2560×1664 display Apple M5 CPU 24GB RAM Mac OS Model: MDHE4LL/A
Read more »
08:19 am
Apple MacBook Air M5 13.6″ Laptop (2026) for $1,150 + free shipping | DealNews Laptops
Apple MacBook Air M5 13.6″ Laptop (2026) for $1,150 + free shipping
Amazon offers the Apple MacBook Air M5 13.6″ Laptop (2026) for $1150. Just released in March, it’s $149 off and the lowest price we’ve seen thus far. Shipping is free. Buy Now at Amazon Features 13.6″ Liquid Retina display 16GB RAM, 1TB SSD up to 18 hours battery life Model: ‎MDHF4LL/A
Read more »
08:19 am
Apple MacBook Air M5 13.6″ Laptop (2026) for $1,150 + free shipping | DealNews Laptops
Apple MacBook Air M5 13.6″ Laptop (2026) for $1,150 + free shipping
Amazon offers the Apple MacBook Air M5 13.6″ Laptop (2026) for $1150. Just released in March, it’s $149 off and the lowest price we’ve seen thus far. Shipping is free. Buy Now at Amazon Features 13.6″ Liquid Retina display 16GB RAM, 1TB SSD up to 18 hours battery life Model: ‎MDHF4LL/A
Read more »

Older posts

No feed items found.