[05/02/2026 13:04] Motta diz esperar que Lula sancione reajuste a servidores da Câmara e que, após isso, vai elevar verba de gabinete dos deputados - G1

[05/02/2026 07:02] Vorcaro impõe condição para depor na CPI do INSS - Revista Oeste

[04/02/2026 21:07] Possível candidatura de Haddad ao Senado preocupa direita em São Paulo - CNN Brasil

[05/02/2026 12:04] Lula diz que conversou com filho citado em CPMI do INSS: 'Se você tiver alguma coisa, vai pagar o preço' - G1

[04/02/2026 19:37] Ministros do STF podem ter participações em empresas, diz Moraes - Poder360

[05/02/2026 12:37] Lula defende instituir mandato para ministros do STF: 'Nada a ver com 8 de janeiro' - O Globo

[05/02/2026 07:25] Tornozeleira de Oruam perdeu sinal 28 vezes em menos de 2 meses; entenda - CNN Brasil

[05/02/2026 15:43] Justiça determina suspensão das escolas cívico-militares em Minas - Estado de Minas

[05/02/2026 09:32] Chove em mais de 100 cidades do Ceará; veja maiores volumes - Diário do Nordeste

[05/02/2026 04:35] 5º dia útil chegando, e trabalhadores ganham direito de receber R$ 300 a mais no pagamento - Portal 6

[CVE-2025-11490] [Modified: 12-12-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term."

[CVE-2025-11491] [Modified: 12-12-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

[CVE-2025-11494] [Modified: 14-10-2025] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.

[CVE-2025-11495] [Modified: 14-10-2025] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.

[CVE-2025-11503] [Modified: 10-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-services.php. Executing manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

[CVE-2025-60311] [Modified: 16-10-2025] [Analyzed] [V3.1 S8.8:HIGH] ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page

[CVE-2025-11505] [Modified: 10-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The manipulation of the argument delid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

[CVE-2025-61913] [Modified: 20-10-2025] [Analyzed] [V3.1 S9.9:CRITICAL] Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

[CVE-2025-11512] [Modified: 10-10-2025] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manipulation of the argument Firstname/Lastname/Platform results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

[CVE-2025-11513] [Modified: 10-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/supplier_update.php. This manipulation of the argument supp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2025-11514] [Modified: 10-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

[CVE-2025-11515] [Modified: 10-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

[CVE-2025-11516] [Modified: 14-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

[CVE-2025-11523] [Modified: 09-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

[CVE-2025-11524] [Modified: 09-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

[CVE-2025-11525] [Modified: 09-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-11528] [Modified: 09-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

[CVE-2025-11529] [Modified: 27-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be exploited. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.

[CVE-2025-11530] [Modified: 09-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation of the argument state causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

[CVE-2025-27039] [Modified: 15-10-2025] [Analyzed] [V3.1 S6.6:MEDIUM] Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.