[10/01/2026 08:34] Entenda por que os EUA querem anexar a Groenlândia - Poder360

[10/01/2026 11:52] Tio de Suzane von Richthofen é encontrado morto em casa - Estado de Minas

[09/01/2026 06:57] Veto de Lula à redução de penas por atos antidemocráticos divide governo e oposição - Senado Federal

[09/01/2026 14:46] Ex-ministro da Saúde: nem a ditadura militar teve a ousadia de Moraes contra o CFM - Gazeta do Povo

[09/01/2026 11:29] Presidente Lula vai reajustar piso do magistério acima da inflação, afirma ministro da Educação - APP-Sindicato

[10/01/2026 13:17] Ciclone traz temporais e ventos de até 100 km/h para SC e Paraná neste domingo - NSC Total

[10/01/2026 09:51] Alerta de calor muito intenso a extremo em São Paulo e no Rio de Janeiro - MetSul Meteorologia

[10/01/2026 07:24] Alok projeta Ponte de Guaratuba com drones no show recorde de público do Verão Maior Paraná - Governo do Estado do Paraná

[10/01/2026 14:33] Lula pede fim de preconceito entre esquerda e direita em vídeo na praia - CNN Brasil

[09/01/2026 16:06] Aneel divulga calendário para anúncio de bandeiras tarifárias em 2026 - Agência Brasil

[CVE-2025-10321] [Modified: 02-10-2025] [Analyzed] [V3.1 S5.3:MEDIUM] A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10322] [Modified: 02-10-2025] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability has been found in Wavlink WL-WN578W2 221110. The affected element is an unknown function of the file /sysinit.html. The manipulation of the argument newpass/confpass leads to weak password recovery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-58434] [Modified: 20-09-2025] [Analyzed] [V3.1 S9.8:CRITICAL] Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.

[CVE-2025-10323] [Modified: 02-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is the function sub_409184 of the file /wizard_rep.shtml. The manipulation of the argument sel_EncrypTyp results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10324] [Modified: 02-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10325] [Modified: 02-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub_401340/sub_401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-43795] [Modified: 16-12-2025] [Analyzed] [V3.1 S6.1:MEDIUM] Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter. Open redirect vulnerability in the Instance Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect parameter. Open redirect vulnerability in the Site Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameter.

[CVE-2025-43796] [Modified: 16-12-2025] [Analyzed] [V3.1 S7.5:HIGH] Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.

[CVE-2025-10326] [Modified: 02-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A security flaw has been discovered in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/api/playlist/single.php. Performing manipulation of the argument playlist results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10327] [Modified: 02-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-45583] [Modified: 16-10-2025] [Analyzed] [V3.1 S9.1:CRITICAL] Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combination of username and password.

[CVE-2025-45584] [Modified: 16-10-2025] [Analyzed] [V3.1 S7.5:HIGH] Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication.

[CVE-2025-45585] [Modified: 16-10-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Multiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the wifi_sta_ssid or wifi_ap_ssid parameters.

[CVE-2025-45586] [Modified: 16-10-2025] [Analyzed] [V3.1 S7.5:HIGH] An issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files via supplying a crafted PUT request.

[CVE-2025-45587] [Modified: 16-10-2025] [Analyzed] [V3.1 S7.0:HIGH] A stack overflow in the FTP service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

[CVE-2025-10328] [Modified: 02-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10329] [Modified: 16-09-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in cdevroe unmark up to 1.9.3. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10330] [Modified: 16-09-2025] [Analyzed] [V3.1 S4.3:MEDIUM] A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This manipulation of the argument q causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10331] [Modified: 16-09-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such manipulation of the argument Title leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-10332] [Modified: 16-09-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability was found in cdevroe unmark up to 1.9.3. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.