Sécurité IT 2026-09-30

Niveau Tendu — 74/100 — 2026-09-30

Journée « Tendu » : 17 sujets classés, 2 des 10 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (86/100).

1. Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability — 86/100 (CVE-2026-76504)
2. Apple Multiple Products Out-of-Bounds Write Vulnerability — 66/100 (CVE-2026-86950)
3. CVE-2026-102427 — Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - sit… — 39/100 (CVE-2026-102427)
4. CVE-2026-76570 — Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1… — 39/100 (CVE-2026-76570)
5. CVE-2026-100255 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via pass… — 38/100 (CVE-2026-100255)
6. CVE-2026-100273 — In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code… — 38/100 (CVE-2026-100273)
7. CVE-2026-100277 — In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature — 38/100 (CVE-2026-100277)
8. Zammad GmbH Zammad Session Fixation Vulnerability — 36/100 (CVE-2026-102489)
9. electronjs electron: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. — 30/100 (CVE-2026-102676)
10. simple-git project simple-git: simple-git, an interface for running git commands in any node.js application, enables applications to execute… — 30/100 (CVE-2026-102827)