[23/02/2026 12:47] Parceira amorosa ajudou em operação que levou à morte de "El Mencho" - CNN Brasil

[23/02/2026 11:20] A tentativa de ‘acordão’ para blindar o STF e o Congresso do Banco Master - O Antagonista

[23/02/2026 00:07] Rodovias para o litoral de SP são interditadas após chuvas e risco de queda - UOL Notícias

[23/02/2026 11:13] Leilão para construção da nova sede do Governo de São Paulo recebe duas propostas - Metrô CPTM

[23/02/2026 06:05] Em 1ª visita de Lula, Coreia do Sul tinha PIB superior ao do Brasil - Poder360

[23/02/2026 13:14] Vazamento de dados: servidora pede a Moraes acesso a “prova decisiva” - Metrópoles

[23/02/2026 08:14] Homem atropela seis pessoas e interrompe pagode em BH - Estado de Minas

[23/02/2026 08:55] CPMI do INSS muda agenda e convoca empresária após ausência de Vorcaro - Correio Braziliense

[23/02/2026 06:55] Estudantes do Irã iniciam nova onda de protestos contra o governo Khamenei - G1

[22/02/2026 08:29] Rússia faz ataque a Kiev com 50 mísseis e 300 drones e causa blecautes por toda a Ucrânia; uma pessoa morreu - G1

[CVE-2025-10497] [Modified: 27-10-2025] [Analyzed] [V3.1 S7.5:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.

[CVE-2025-11447] [Modified: 27-10-2025] [Analyzed] [V3.1 S7.5:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

[CVE-2025-11971] [Modified: 28-10-2025] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

[CVE-2025-11974] [Modified: 28-10-2025] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

[CVE-2025-11989] [Modified: 28-10-2025] [Analyzed] [V3.1 S3.7:LOW] GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

[CVE-2025-6601] [Modified: 28-10-2025] [Analyzed] [V3.1 S2.7:LOW] GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

[CVE-2025-12201] [Modified: 15-01-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-12202] [Modified: 15-01-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-62969] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Stored XSS.This issue affects NextMove Lite: from n/a through <= 2.21.0.

[CVE-2025-62972] [Modified: 03-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.

[CVE-2025-12203] [Modified: 07-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

[CVE-2025-12208] [Modified: 28-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

[CVE-2025-12209] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

[CVE-2025-12212] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

[CVE-2025-12213] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

[CVE-2025-12214] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing manipulation of the argument enable results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

[CVE-2025-12215] [Modified: 28-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

[CVE-2025-12222] [Modified: 21-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-12223] [Modified: 21-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-12225] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Request Handler. Such manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.