Sécurité IT 2026-07-23

Niveau Tendu — 73/100 — 2026-07-23

Journée « Tendu » : 10 sujets classés, 2 des 10 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (81/100).

1. Microsoft SharePoint Deserialization of Untrusted Data Vulnerability — 81/100 (CVE-2026-50522)
2. Check Point SmartConsole Improper Authentication Vulnerability — 67/100 (CVE-2026-16232)
3. CVE-2026-65906 — In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible — 39/100 (CVE-2026-65906)
4. CVE-2026-10697 — Improper Authentication vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-10697)
5. CVE-2026-15966 — Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-15966)
6. CVE-2026-15967 — Insufficient session expiration vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-15967)
7. CVE-2026-64815 — In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files — 38/100 (CVE-2026-64815)
8. katacontainers kata containers: Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machin… — 22/100 (CVE-2026-44210)
9. CVE-2026-65590 — n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows i… — 18/100 (CVE-2026-65590)
10. nlnetlabs unbound: In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve… — 17/100 (CVE-2026-50252)