Sécurité IT 2026-10-09

Niveau Critique — 99/100 — 2026-10-09

Journée « Critique » : 24 sujets classés, 5 des 10 premiers signalés comme activement exploités, 5 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : ProFTPD Improper Access Control Vulnerability (90/100).

ProFTPD Improper Access Control Vulnerability — 90/100 (CVE-2015-3306)
Apache Struts Command Injection Vulnerability — 85/100 (CVE-2016-3081)
ISC BIND Data Processing Errors Vulnerability — 84/100 (CVE-2015-5477)
ONLYOFFICE Docs Server Path Traversal Vulnerability — 78/100 (CVE-2021-3199)
Strapi Cleartext Storage of Sensitive Information Vulnerability — 60/100 (CVE-2023-22894)
CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRA… — 36/100 (CVE-2026-108107)
CVE-2026-14888 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0… — 30/100 (CVE-2026-14888)
CVE-2026-82335 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB pr… — 30/100 (CVE-2026-82335)
CVE-2026-82344 — IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap… — 30/100 (CVE-2026-82344)
CVE-2026-82895 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due… — 30/100 (CVE-2026-82895)