[07/03/2026 01:00] INFOGRÁFICOS: mapa mostra troca de ataques e marcos da primeira semana de guerra no Irã - G1

[07/03/2026 16:07] Flávio Bolsonaro registra B.O. após mensagem no X sobre facada - CartaCapital

[07/03/2026 15:32] Trump recebe 12 líderes em cúpula de direita para defesa das Américas - Poder360

[07/03/2026 14:18] Em derrota do grupo de Boulos, Psol rejeita federação com o PT por ampla maioria - O Globo

[07/03/2026 15:59] Verificamos: é falso que frrente fria fora do normal atingirá o Brasil - MetSul Meteorologia

[07/03/2026 10:10] Presidente da CPMI do INSS se pronuncia sobre vazamentos de supostas conversas entre Moraes e Vorcaro - Revista Fórum

[06/03/2026 15:32] Adolescente envolvido em caso de estupro coletivo em Copacabana é apreendido - O Dia

[06/03/2026 10:32] Justiça de SP autoriza exumação do corpo de policial morta com tiro na cabeça - Jovem Pan

[06/03/2026 11:20] Réu por morte do advogado Rodrigo Crespo diz que foi contratado por marido traído - G1

[07/03/2026 17:02] Atentado com bomba em boate deixa mais de 30 feridos no Peru - O Globo

[CVE-2025-63543] [Modified: 21-11-2025] [Analyzed] [V3.1 S6.1:MEDIUM] TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter.

[CVE-2025-63544] [Modified: 21-11-2025] [Analyzed] [V3.1 S6.1:MEDIUM] TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter.

[CVE-2025-64442] [Modified: 26-11-2025] [Analyzed] [V3.1 S6.1:MEDIUM] HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.

[CVE-2025-60574] [Modified: 11-12-2025] [Analyzed] [V3.1 S7.5:HIGH] A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.

[CVE-2025-63420] [Modified: 05-02-2026] [Analyzed] [V3.1 S4.1:MEDIUM] CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.

[CVE-2025-37736] [Modified: 11-12-2025] [Analyzed] [V3.1 S8.8:HIGH] Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/_all delete:/users/auth/keys/{api_key_id} delete:/users/{user_id}/auth/keys delete:/users/{user_id}/auth/keys/{api_key_id} delete:/users/{user_name} patch:/users/{user_name}

[CVE-2025-64433] [Modified: 25-11-2025] [Analyzed] [V3.1 S6.5:MEDIUM] KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM. Specifically, if a malicious user has full or partial control over the contents of a PVC, they can create a symbolic link that points to a file within the virt-launcher pod's file system. Since libvirt can treat regular files as block devices, any file on the pod's file system that is symlinked in this way can be mounted into the VM and subsequently read. Although a security mechanism exists where VMs are executed as an unprivileged user with UID 107 inside the virt-launcher container, limiting the scope of accessible resources, this restriction is bypassed due to a second vulnerability. The latter causes the ownership of any file intended for mounting to be changed to the unprivileged user with UID 107 prior to mounting. As a result, an attacker can gain access to and read arbitrary files located within the virt-launcher pod's file system or on a mounted PVC from within the guest VM. This vulnerability is fixed in 1.5.3 and 1.6.1.

[CVE-2025-64434] [Modified: 25-11-2025] [Analyzed] [V3.1 S4.7:MEDIUM] KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.

[CVE-2025-64435] [Modified: 25-11-2025] [Analyzed] [V3.1 S5.3:MEDIUM] KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.

[CVE-2025-64436] [Modified: 25-11-2025] [Analyzed] [V3.1 S5.3:MEDIUM] KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node.

[CVE-2025-64437] [Modified: 25-11-2025] [Analyzed] [V3.1 S5.0:MEDIUM] KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.

[CVE-2025-12905] [Modified: 21-11-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)

[CVE-2025-12906] [Modified: 21-11-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

[CVE-2025-12907] [Modified: 21-11-2025] [Analyzed] [V3.1 S8.8:HIGH] Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)

[CVE-2025-12908] [Modified: 21-11-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

[CVE-2025-12909] [Modified: 21-11-2025] [Analyzed] [V3.1 S5.3:MEDIUM] Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)

[CVE-2025-12910] [Modified: 21-11-2025] [Analyzed] [V3.1 S6.2:MEDIUM] Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low)

[CVE-2025-12911] [Modified: 21-11-2025] [Analyzed] [V3.1 S4.3:MEDIUM] Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

[CVE-2025-64488] [Modified: 25-11-2025] [Analyzed] [V3.1 S8.8:HIGH] SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1.

[CVE-2025-64489] [Modified: 25-11-2025] [Analyzed] [V3.1 S8.3:HIGH] SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.