Sécurité IT 2026-10-15

Niveau Critique — 83/100 — 2026-10-15

Journée « Critique » : 15 sujets classés, 5 des 10 premiers signalés comme activement exploités, 5 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Ahsay AhsayCBS Command Injection Vulnerability (70/100).

1. Ahsay AhsayCBS Command Injection Vulnerability — 70/100 (CVE-2026-105134)
2. Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability — 69/100 (CVE-2026-21589)
3. Cisco Secure Email Gateway Relative Path Traversal Vulnerability — 69/100 (CVE-2026-76519)
4. Palo Alto Networks PAN-OS Code Injection Vulnerability — 65/100 (CVE-2026-0322)
5. Ahsay AhsayCBS Improper Authentication Vulnerability — 60/100 (CVE-2026-105133)
6. CVE-2026-111094 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the… — 38/100 (CVE-2026-111094)
7. BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability — 36/100 (CVE-2026-102764)
8. nodejs undici: undici is an HTTP client library for Node.js. — 35/100 (CVE-2026-109383)
9. nodejs undici: undici is an HTTP client library for Node.js. — 35/100 (CVE-2026-109829)
10. CVE-2020-37282 — office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execut… — 33/100 (CVE-2020-37282)