Sécurité IT 2026-06-25

Niveau Tendu — 75/100 — 2026-06-25

Journée « Tendu » : 20 sujets classés, 2 des 10 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (82/100).

1. Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability — 82/100 (CVE-2026-20230)
2. PTC Windchill and FlexPLM Improper Input Validation Vulnerability — 76/100 (CVE-2026-12569)
3. flowiseai flowise: Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthe… — 39/100 (CVE-2025-71338)
4. flowiseai flowise: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachme… — 36/100 (CVE-2025-71333)
5. anysphere cursor: Cursor is a code editor built for programming with AI. — 36/100 (CVE-2026-50548)
6. anysphere cursor: Cursor is a code editor built for programming with AI. — 36/100 (CVE-2026-50549)
7. CVE-2026-54030 — LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. — 36/100 (CVE-2026-54030)
8. dest-unreach socat: socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malic… — 35/100 (CVE-2026-56123)
9. CVE-2026-8592 — OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux… — 30/100 (CVE-2026-8592)
10. CVE-2026-8660 — OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows re… — 30/100 (CVE-2026-8660)