Sécurité IT 2026-10-08

Niveau Critique — 98/100 — 2026-10-08

Journée « Critique » : 28 sujets classés, 5 des 10 premiers signalés comme activement exploités, 5 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : ProFTPD Improper Access Control Vulnerability (90/100).

ProFTPD Improper Access Control Vulnerability — 90/100 (CVE-2015-3306)
Apache Struts Command Injection Vulnerability — 85/100 (CVE-2016-3081)
ISC BIND Data Processing Errors Vulnerability — 84/100 (CVE-2015-5477)
ONLYOFFICE Docs Server Path Traversal Vulnerability — 75/100 (CVE-2021-3199)
Strapi Cleartext Storage of Sensitive Information Vulnerability — 60/100 (CVE-2023-22894)
CVE-2026-14888 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0… — 38/100 (CVE-2026-14888)
CVE-2026-14988 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0… — 38/100 (CVE-2026-14988)
CVE-2026-81932 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. — 38/100 (CVE-2026-81932)
CVE-2026-82335 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB pr… — 38/100 (CVE-2026-82335)
CVE-2026-82344 — IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap… — 38/100 (CVE-2026-82344)