[18/03/2026 11:51] Quem é Jiló: traficante morto em operação da PM tinha 135 anotações criminais; veja histórico - Extra online

[18/03/2026 16:08] Pizzaria é interditada depois de morte e mais de 100 casos de intoxicação - Revista Oeste

[18/03/2026 11:11] Investigação indica manipulação da cena para forjar suicídio de PM morta - CNN Brasil

[18/03/2026 15:04] Advogado de Vorcaro se reuniu com Mendonça para discutir delação, diz site - Estado de Minas

[18/03/2026 15:22] Ataque a campos de gás do Irã é ponto de virada na guerra, diz especialista - CNN Brasil

[18/03/2026 12:41] Martha Graeff não é “só namorada” de Vorcaro, diz Viana - Poder360

[18/03/2026 14:10] Flávio rompe com grupo de Ratinho Junior e vai apoiar Moro, que ainda avalia filiação ao PL - O Globo

[17/03/2026 21:06] Caminhoneiros articulam greve nacional em reação à alta do diesel - Poder360

[18/03/2026 16:57] Fabiana Bolsonaro se pinta de marrom para protestar contra Erika Hilton - O Antagonista

[18/03/2026 10:30] Petistas fazem ofensiva contra André Mendonça após decisão no STF - Metrópoles

[CVE-2025-63215] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.2:HIGH] The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.

[CVE-2025-63216] [Modified: 15-01-2026] [Analyzed] [V3.1 S10.0:CRITICAL] The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.

[CVE-2025-63217] [Modified: 15-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.

[CVE-2025-63229] [Modified: 06-12-2025] [Analyzed] [V3.1 S5.4:MEDIUM] The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint. By injecting a malicious JavaScript payload into the ?m= query parameter, an attacker can execute arbitrary code in the victim's browser, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions.

[CVE-2025-62406] [Modified: 25-11-2025] [Analyzed] [V3.1 S8.1:HIGH] Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.

[CVE-2025-64324] [Modified: 25-11-2025] [Analyzed] [V3.1 S7.7:HIGH] KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.

[CVE-2025-64325] [Modified: 15-01-2026] [Analyzed] [V3.1 S9.0:CRITICAL] Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta.

[CVE-2025-64515] [Modified: 02-12-2025] [Analyzed] [V3.1 S4.3:MEDIUM] Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.

[CVE-2025-65012] [Modified: 26-11-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed. This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. This issue has been patched in version 5.1.4.

[CVE-2025-65013] [Modified: 20-11-2025] [Analyzed] [V3.1 S6.2:MEDIUM] LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser. This issue has been patched in version 25.11.0.

[CVE-2025-65014] [Modified: 20-11-2025] [Analyzed] [V3.1 S3.7:LOW] LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as 12345678. This exposes the platform to brute-force and credential stuffing attacks. This issue has been patched in version 25.11.0.

[CVE-2025-65015] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.5:HIGH] joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2.

[CVE-2025-65093] [Modified: 20-11-2025] [Analyzed] [V3.1 S5.5:MEDIUM] LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0.

[CVE-2025-13225] [Modified: 08-01-2026] [Analyzed] [V3.1 S5.6:MEDIUM] Tanium addressed an arbitrary file deletion vulnerability in TanOS.

[CVE-2025-12426] [Modified: 12-12-2025] [Analyzed] [V3.1 S5.3:MEDIUM] The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question.

[CVE-2025-13206] [Modified: 26-11-2025] [Analyzed] [V3.1 S7.2:HIGH] The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability.

[CVE-2025-11446] [Modified: 02-12-2025] [Analyzed] [V3.1 S6.5:MEDIUM] Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12.

[CVE-2025-11230] [Modified: 19-12-2025] [Analyzed] [V3.1 S7.5:HIGH] Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

[CVE-2025-58412] [Modified: 20-11-2025] [Analyzed] [V3.1 S4.7:MEDIUM] A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.

[CVE-2025-64408] [Modified: 25-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.  This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue.