Sécurité IT 2026-07-27

Niveau Tendu — 72/100 — 2026-07-27

Journée « Tendu » : 7 sujets classés, 2 des 7 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (87/100).

  1. Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability — 87/100 (CVE-2026-16812)
  2. Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability — 60/100 (CVE-2025-68686)
  3. CVE-2026-55971 — Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. — 36/100 (CVE-2026-55971)
  4. CVE-2026-45623 — PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into a… — 35/100 (CVE-2026-45623)
  5. CVE-2026-48144 — Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. — 35/100 (CVE-2026-48144)
  6. CVE-2026-58662 — Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bin… — 34/100 (CVE-2026-58662)
  7. CVE-2026-58023 — Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. — 27/100 (CVE-2026-58023)