[28/02/2026 13:02] Fogo atinge hotel de luxo em Dubai - G1

[27/02/2026 21:09] Amiga de mulher que morreu após ser resgatada conta sobre a perda - Estado de Minas

[27/02/2026 23:28] Argentina aprova reforma trabalhista de Milei com jornada de 12 horas - UOL Economia

[28/02/2026 13:01] Irã decreta fechamento do Estreito de Ormuz após ataques dos EUA e Israel - Brasil 247

[27/02/2026 19:03] Polícia desvenda últimas horas de vida do secretário que matou os filhos - Metrópoles

[27/02/2026 23:45] Avião carregado de dinheiro cai na Bolívia e deixa ao menos 20 mortos - BBC

[28/02/2026 04:30] Pela 1ª vez, Lulinha enfrenta ofensiva simultânea de PF, STF e CPMI - CNN Brasil

[28/02/2026 10:40] Presidente do Republicanos confirma que Cleitinho será candidato ao governo - Estado de Minas

[27/02/2026 21:33] Flávio Bolsonaro vai acabar com a maioridade penal, afirma Valdemar - Revista Oeste

[27/02/2026 15:13] Mendonça autoriza ida de Daniel Vorcaro a comissão no Senado - CartaCapital

[CVE-2025-62264] [Modified: 10-11-2025] [Analyzed] [V3.1 S6.1:MEDIUM] Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.

[CVE-2025-63459] [Modified: 05-11-2025] [Analyzed] [V3.1 S7.5:HIGH] Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-12546] [Modified: 07-11-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-12547] [Modified: 07-11-2025] [Analyzed] [V3.1 S3.7:LOW] A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-62267] [Modified: 10-11-2025] [Analyzed] [V3.1 S6.1:MEDIUM] Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name, or (3) Last Name text field.

[CVE-2025-62618] [Modified: 10-11-2025] [Analyzed] [V3.1 S8.0:HIGH] ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text.

[CVE-2025-63454] [Modified: 05-11-2025] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-63458] [Modified: 05-11-2025] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-64348] [Modified: 10-11-2025] [Analyzed] [V3.1 S7.1:HIGH] ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enabled with the "-x" command line flag, attackers could execute OS commands on the host machine. By default, ELOG is not configured to allow shell commands or self-registration.

[CVE-2025-64349] [Modified: 10-11-2025] [Analyzed] [V3.1 S8.8:HIGH] ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration.

[CVE-2025-60711] [Modified: 05-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

[CVE-2025-63561] [Modified: 05-11-2025] [Analyzed] [V3.1 S7.5:HIGH] Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s connection pool and worker capacity, preventing legitimate users and APIs from accessing the service.

[CVE-2025-63562] [Modified: 05-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).

[CVE-2025-63563] [Modified: 05-11-2025] [Analyzed] [V3.1 S6.5:MEDIUM] Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.

[CVE-2025-62276] [Modified: 10-11-2025] [Analyzed] [V3.1 S5.5:MEDIUM] The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

[CVE-2025-62275] [Modified: 10-11-2025] [Analyzed] [V3.1 S5.3:MEDIUM] Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

[CVE-2025-36367] [Modified: 05-11-2025] [Analyzed] [V3.1 S8.8:HIGH] IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system.

[CVE-2025-12599] [Modified: 10-11-2025] [Analyzed] [V3.1 S9.8:CRITICAL] Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

[CVE-2025-12600] [Modified: 10-11-2025] [Analyzed] [V3.1 S9.8:CRITICAL] Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

[CVE-2025-12601] [Modified: 10-11-2025] [Analyzed] [V3.1 S7.5:HIGH] Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.