Sécurité IT 2026-08-04

Niveau Critique — 85/100 — 2026-08-04

Journée « Critique » : 21 sujets classés, 4 des 10 premiers signalés comme activement exploités, 4 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (82/100).

1. Apache Tomcat Missing Encryption of Sensitive Data Vulnerability — 82/100 (CVE-2026-34486)
2. IBM Langflow Code Injection Vulnerability — 69/100 (CVE-2026-9198)
3. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 66/100 (CVE-2026-18577)
4. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 62/100 (CVE-2026-18556)
5. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 37/100 (CVE-2026-70470)
6. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 37/100 (CVE-2026-70477)
7. flowiseai flowise: Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly… — 36/100 (CVE-2026-69264)
8. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 35/100 (CVE-2026-70478)
9. flowiseai flowise: Flowise is a drag & drop user interface to build a customized large language model flow. — 34/100 (CVE-2026-69258)
10. CVE-2026-10050 — In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as b… — 34/100 (CVE-2026-10050)