[05/03/2026 02:51] Irã nega ter disparado míssil em direção à Turquia e afirma respeitar a soberania do país - G1

[05/03/2026 00:30] Planilha aponta Moraes, esposa e Toffoli em mesa do Banco Master - Metrópoles

[05/03/2026 00:03] Comissão dos EUA acusa China de operar instalações com potencial uso militar na América Latina, incluindo locais no Brasil - G1

[05/03/2026 03:27] Após ataque a fragata, Irã diz que os EUA "vão lamentar amargamente" - CNN Brasil

[04/03/2026 20:08] Aumento gradual da licença-paternidade vai à sanção presidencial - Senado Federal

[05/03/2026 11:13] Presos por estupro coletivo em Copacabana estão em celas separadas em cadeia no Rio - G1

[05/03/2026 06:21] Aviões militares russos são detectados perto do Alasca por EUA e Canadá - O Globo

[03/03/2026 23:59] Ataque com drones iranianos atinge estação da CIA na Arábia Saudita - CNN Brasil

[04/03/2026 10:37] Força Aérea de Israel abate jato tripulado nos céus de Teerã - Gazeta do Povo

[05/03/2026 07:25] Caixa tem lucro líquido de R$ 15,5 bilhões em 2025, alta de 10,4% ante 2024 - UOL Economia

[CVE-2025-3125] [Modified: 04-12-2025] [Analyzed] [V3.1 S6.7:MEDIUM] An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.

[CVE-2025-46404] [Modified: 07-11-2025] [Analyzed] [V3.1 S7.5:HIGH] A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

[CVE-2025-46705] [Modified: 07-11-2025] [Analyzed] [V3.1 S7.5:HIGH] A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

[CVE-2025-46784] [Modified: 07-11-2025] [Analyzed] [V3.1 S7.5:HIGH] A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

[CVE-2025-47151] [Modified: 07-11-2025] [Analyzed] [V3.1 S9.8:CRITICAL] A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.

[CVE-2025-64458] [Modified: 10-11-2025] [Analyzed] [V3.1 S7.5:HIGH] An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

[CVE-2025-64459] [Modified: 10-11-2025] [Analyzed] [V3.1 S9.1:CRITICAL] An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

[CVE-2025-57130] [Modified: 02-02-2026] [Analyzed] [V3.1 S8.3:HIGH] An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user, including administrators.

[CVE-2025-60753] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

[CVE-2025-61304] [Modified: 08-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.

[CVE-2025-20289] [Modified: 19-11-2025] [Analyzed] [V3.1 S4.8:MEDIUM] Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

[CVE-2025-20303] [Modified: 19-11-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

[CVE-2025-20304] [Modified: 19-11-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

[CVE-2025-20305] [Modified: 19-11-2025] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could exploit this vulnerability by performing actions where the results should only be viewable to a high-privileged user. A successful exploit could allow the attacker to view passwords that are normally not visible to read-only administrators.

[CVE-2025-20343] [Modified: 19-11-2025] [Analyzed] [V3.1 S8.6:HIGH] A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.

[CVE-2025-20354] [Modified: 07-11-2025] [Analyzed] [V3.1 S9.8:CRITICAL] A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system. This vulnerability is due to improper authentication mechanisms that are associated to specific Cisco Unified CCX features. An attacker could exploit this vulnerability by uploading a crafted file to an affected system through the Java RMI process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.

[CVE-2025-20358] [Modified: 07-11-2025] [Analyzed] [V3.1 S9.4:CRITICAL] A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.

[CVE-2025-20374] [Modified: 17-11-2025] [Analyzed] [V3.1 S4.9:MEDIUM] A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.

[CVE-2025-20375] [Modified: 17-11-2025] [Analyzed] [V3.1 S6.5:MEDIUM] A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a crafted file to the web UI. A successful exploit could allow the attacker to upload arbitrary files to a vulnerable system and execute them, gaining access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.

[CVE-2025-20376] [Modified: 17-11-2025] [Analyzed] [V3.1 S6.5:MEDIUM] A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the web UI and executing it. A successful exploit could allow the attacker to execute arbitrary commands on the underlying system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.