Sécurité IT 2026-07-28

Niveau Tendu — 66/100 — 2026-07-28

Journée « Tendu » : 10 sujets classés, 2 des 10 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (69/100).

1. Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability — 69/100 (CVE-2026-16812)
2. Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability — 60/100 (CVE-2025-68686)
3. CVE-2026-14974 — IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary… — 38/100 (CVE-2026-14974)
4. CVE-2026-14976 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution wit… — 38/100 (CVE-2026-14976)
5. CVE-2026-16184 — IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sendi… — 38/100 (CVE-2026-16184)
6. CVE-2026-55971 — Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. — 30/100 (CVE-2026-55971)
7. CVE-2026-58662 — Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bin… — 28/100 (CVE-2026-58662)
8. CVE-2026-45623 — PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into a… — 28/100 (CVE-2026-45623)
9. CVE-2026-48144 — Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. — 28/100 (CVE-2026-48144)
10. CVE-2026-58023 — Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. — 23/100 (CVE-2026-58023)