Sécurité IT 2026-08-05

Niveau Critique — 90/100 — 2026-08-05

Journée « Critique » : 20 sujets classés, 4 des 10 premiers signalés comme activement exploités, 4 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (84/100).

1. Apache Tomcat Missing Encryption of Sensitive Data Vulnerability — 84/100 (CVE-2026-34486)
2. IBM Langflow Code Injection Vulnerability — 79/100 (CVE-2026-9198)
3. JetBrains TeamCity Deserialization of Untrusted Data Vulnerability — 77/100 (CVE-2026-63077)
4. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 63/100 (CVE-2026-18556)
5. CVE-2026-10025 — IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity… — 38/100 (CVE-2026-10025)
6. redhat build of keycloak: A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and us… — 38/100 (CVE-2026-16442)
7. CVE-2026-17617 — IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due t… — 38/100 (CVE-2026-17617)
8. CVE-2026-8400 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous deliv… — 38/100 (CVE-2026-8400)
9. CVE-2026-9205 — IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() functi… — 38/100 (CVE-2026-9205)
10. redhat build of keycloak: A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the c… — 35/100 (CVE-2026-16443)