Sécurité IT 2026-09-26

Niveau Critique — 78/100 — 2026-09-26

Journée « Critique » : 8 sujets classés, 3 des 8 premiers signalés comme activement exploités, 3 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : WordPress Core Remote File Inclusion Vulnerability (75/100).

1. WordPress Core Remote File Inclusion Vulnerability — 75/100 (CVE-2026-87902)
2. Microsoft SharePoint Code Injection Vulnerability — 67/100 (CVE-2026-65660)
3. Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability — 61/100 (CVE-2026-67279)
4. CVE-2026-97163 — Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6… — 39/100 (CVE-2026-97163)
5. CVE-2026-94130 — Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An S… — 36/100 (CVE-2026-94130)
6. CVE-2026-97162 — Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 — 32/100 (CVE-2026-97162)
7. CVE-2026-97063 — X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GE… — 28/100 (CVE-2026-97063)
8. broadcom rabbitmq server: RabbitMQ is a messaging and streaming broker. — 24/100 (CVE-2026-67237)