Veille
Veille en cybersécurité
Restez informé grâce à une sélection d’alertes de cybersécurité, d’avis de vulnérabilité et de conseils en sécurité issus de sources gouvernementales et industrielles reconnues.
Conseils canadiens en cybersécurité
- CCCSAV26-1087
Bulletin de sécurité HashiCorp (AV26-1087)
Numéro de série : AV26-1087Date : 26 octobre 2026 En date du 26 octobre 2026, HashiCorp est touché par une vulnérabilité dans les produits suivants : Consul Versions…
Lire à la source — Bulletin de sécurité HashiCorp (AV26-1087) - CCCSAV26-1086
Bulletin de sécurité craftcms (AV26-1086)
Numéro de série : AV26-1086Date : 26 octobre 2026 En date du 23 octobre 2026, Craft CMS est touché par des vulnérabilités dans les produits suivants : CMS…
Lire à la source — Bulletin de sécurité craftcms (AV26-1086) - CCCSAV26-1085
Bulletin de sécurité Google (AV26-1085)
Numéro de série : AV26-1085Date : 26 octobre 2026 En date du 22 octobre 2026, Google est touché par une vulnérabilité dans le produit suivant : Brotli Versions…
Lire à la source — Bulletin de sécurité Google (AV26-1085) - CCCSAV26-1084
Bulletin de sécurité Red Hat (AV26-1084)
Numéro de série : AV26-1084Date : 22 octobre 2026 En date du 20 octobre 2026, Red Hat est touché par des vulnérabilités dans les produits suivants : Red…
Lire à la source — Bulletin de sécurité Red Hat (AV26-1084) - CCCSAV26-1083
[Systèmes de contrôle] Bulletin de sécurité Siemens (AV26-1083)
Numéro de série : AV26-1083Date : 26 octobre 2026 En date du 26 octobre 2026, Siemens est touché par une vulnérabilité dans les produits suivants : Mendix SAML…
Lire à la source — [Systèmes de contrôle] Bulletin de sécurité Siemens (AV26-1083) - CCCSAV26-1082
Bulletin de sécurité IBM (AV26-1082)
Numéro de série : AV26-1082Date : 26 octobre 2026 En date du 20 octobre 2026, IBM est touché par des vulnérabilités dans les produits suivants : IBM App…
Lire à la source — Bulletin de sécurité IBM (AV26-1082) - CCCSAV26-1080
Bulletin de sécurité Arista Networks (AV26-1080) – Mise à jour 1
Numéro de série : AV26-1080Date : 23 octobre 2026 En date du 22 octobre 2026, Arista Networks est touché par une vulnérabilité dans le produit suivant : VeloCloud…
Lire à la source — Bulletin de sécurité Arista Networks (AV26-1080) – Mise à jour 1 - CCCSCVE-2026-109618
AL26-026 - Vulnérabilités critiques touchant PHP – CVE-2026-109618 et CVE-2026-109619 - Mise à jour 1
Numéro : AL26-026Date : 21 octobre 2026Mise à jour : 23 octobre 2026 Audience La présente alerte s’adresse aux professionnelles et professionnels des TI et aux gestionnaires. Objet…
Lire à la source — AL26-026 - Vulnérabilités critiques touchant PHP – CVE-2026-109618 et CVE-2026-109619 - Mise à jour 1
Avis de sécurité des fournisseurs
- PSIRT
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private…
Lire à la source — Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities - PSIRT
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE…
Lire à la source — Vulnerabilities in PHP Affecting Cisco Products: October 2026 - MSRCCVE-2026-69926
CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability - MSRCCVE-2026-105728
CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability - MSRCCVE-2026-96311
CVE-2026-96311 Windows Network List Service Tampering Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-96311 Windows Network List Service Tampering Vulnerability - MSRCCVE-2026-69923
CVE-2026-69923 Windows AI Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-69923 Windows AI Elevation of Privilege Vulnerability - MSRCCVE-2026-70054
CVE-2026-70054 Windows NetBIOS Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-70054 Windows NetBIOS Elevation of Privilege Vulnerability - MSRCCVE-2026-96234
CVE-2026-96234 .NET Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-96234 .NET Information Disclosure Vulnerability - MSRCCVE-2026-70338
CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability - MSRCCVE-2026-83519
CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
Lire à la source — CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability - PSIRT
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection…
Lire à la source — Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability - PSIRT
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security…
Lire à la source — Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 - PSIRT
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to…
Lire à la source — Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities - PSIRT
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated,…
Lire à la source — Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability - PSIRT
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly…
Lire à la source — Multiple Cisco Products Snort 3 Denial of Service Vulnerability - PSIRT
Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3…
Lire à la source — Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Alertes critiques et menaces actives
- CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP…
Lire à la source — CISA Adds Two Known Exploited Vulnerabilities to Catalog - CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command…
Lire à la source — CISA Adds One Known Exploited Vulnerability to Catalog - CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type…
Lire à la source — CISA Adds One Known Exploited Vulnerability to Catalog - CISA
Siemens Software Center
View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL…
Lire à la source — Siemens Software Center - CISA
Siemens PSS(R)SINCAL
View CSAF Summary PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a…
Lire à la source — Siemens PSS(R)SINCAL - CISA
InterSystems Corporation InterSystems IRIS for Health
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions…
Lire à la source — InterSystems Corporation InterSystems IRIS for Health - CISA
Siemens RUGGEDCOM CROSSBOW Station Access Controller
View CSAF Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a…
Lire à la source — Siemens RUGGEDCOM CROSSBOW Station Access Controller - CISA
Siemens SENTRON 3NA COM Fuse
View CSAF Summary SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition.…
Lire à la source — Siemens SENTRON 3NA COM Fuse
Vulnérabilités et mises à jour de sécurité
- USNUSN-8956-1
USN-8956-1: Brotli vulnerability
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
Lire à la source — USN-8956-1: Brotli vulnerability - USNUSN-8955-1
USN-8955-1: nginx vulnerabilities
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx…
Lire à la source — USN-8955-1: nginx vulnerabilities - USNUSN-8954-1
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial…
Lire à la source — USN-8954-1: zlib vulnerability - USNUSN-8953-1
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Lire à la source — USN-8953-1: OpenVPN vulnerability - USNUSN-8952-1
USN-8952-1: Tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service,…
Lire à la source — USN-8952-1: Tornado vulnerabilities - USNUSN-8890-2
USN-8890-2: libsoup vulnerabilities
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2…
Lire à la source — USN-8890-2: libsoup vulnerabilities - USNUSN-8951-1
USN-8951-1: c-ares vulnerabilities
It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of…
Lire à la source — USN-8951-1: c-ares vulnerabilities - USNUSN-8947-1
USN-8947-1: NSS update
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
Lire à la source — USN-8947-1: NSS update
Dernière mise à jour : 27 octobre 2026.
Discutons de vos priorités en cybersécurité.
Un premier échange, sans engagement, pour comprendre votre contexte, vos priorités et vos besoins.