[05/02/2026 07:02] Vorcaro impõe condição para depor na CPI do INSS - Revista Oeste

[05/02/2026 06:27] Escolas cívico-militares: As denúncias de assédio sexual de alunas por PMs no Paraná - BBC News Brasil - BBC

[05/02/2026 09:32] Chove em mais de 100 cidades do Ceará; veja maiores volumes - Diário do Nordeste

[05/02/2026 12:35] Alece aprova reajuste salarial, planejamento domiciliar e mudança nas férias de professores do Ceará - Diário do Nordeste

[05/02/2026 04:35] 5º dia útil chegando, e trabalhadores ganham direito de receber R$ 300 a mais no pagamento - Portal 6

[05/02/2026 12:58] Lula diz que encontrou Vorcaro e que não haverá interferência no Master - Correio Braziliense

[05/02/2026 05:57] Cuba diz que pode dialogar com EUA, mas não sobre mudança de regime - CNN Brasil

[04/02/2026 11:25] Xi conversa com Trump e faz alerta sobre Taiwan - Valor Econômico

[05/02/2026 06:01] Visto eletrônico para brasileiros entra em vigor no México a partir desta semana; entenda - Rádio Itatiaia

[04/02/2026 02:01] 72% da população mundial vive sob regimes autoritários, indica Human Rights Watch - G1

[CVE-2025-11487] [Modified: 09-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProduct.php. Performing manipulation of the argument Type results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

[CVE-2025-11489] [Modified: 12-12-2025] [Analyzed] [V3.1 S4.5:MEDIUM] A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: "Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We'll keep this issue open for future consideration if we receive more user demand for improved restrictions." This vulnerability only affects products that are no longer supported by the maintainer.

[CVE-2025-61788] [Modified: 09-10-2025] [Analyzed] [V3.1 S5.4:MEDIUM] Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified. The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers of users watching the prepared media. This can then be used to modify the site or to execute actions in the name of logged-in users. To inject malicious metadata, an attacker needs write access to the system. For example, the ability to upload media and modify metadata. This cannot be exploited by unauthenticated users. This issue is fixed in Opencast 17.8 and 18.2.

[CVE-2025-61906] [Modified: 09-10-2025] [Analyzed] [V3.1 S4.3:MEDIUM] Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on "Save & Publish" before then selecting the "Save" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2.

[CVE-2025-11490] [Modified: 12-12-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term."

[CVE-2025-11491] [Modified: 12-12-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

[CVE-2025-11494] [Modified: 14-10-2025] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.

[CVE-2025-11495] [Modified: 14-10-2025] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.

[CVE-2025-11503] [Modified: 10-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-services.php. Executing manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

[CVE-2025-60311] [Modified: 16-10-2025] [Analyzed] [V3.1 S8.8:HIGH] ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page

[CVE-2025-11505] [Modified: 10-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The manipulation of the argument delid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

[CVE-2025-61913] [Modified: 20-10-2025] [Analyzed] [V3.1 S9.9:CRITICAL] Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

[CVE-2025-11512] [Modified: 10-10-2025] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manipulation of the argument Firstname/Lastname/Platform results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

[CVE-2025-11513] [Modified: 10-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/supplier_update.php. This manipulation of the argument supp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2025-11514] [Modified: 10-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

[CVE-2025-11515] [Modified: 10-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

[CVE-2025-11516] [Modified: 14-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

[CVE-2025-11523] [Modified: 09-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

[CVE-2025-11524] [Modified: 09-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

[CVE-2025-11525] [Modified: 09-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.