Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability
Microsoft Qlib's StaticDataLoader can deserialize untrusted data, enabling remote code execution. Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution is possible via Qlib's RestrictedUnpickler deserialization of untrusted data, requiring user interaction.
Read more → -
ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
CISA KEV — Ivanti Connect Secure (CVE-2026-111357) +1 more
Ivanti Connect Secure has two vulnerabilities now listed in CISA’s KEV Catalog.
Read more → -
CISA KEV — Ivanti Connect Secure (CVE-2026-111357) +1 more
CISA added CVE-2026-111357 for Ivanti Connect Secure and CVE-2026-97229 for GitLab CE/EE to its KEV catalog.
Read more → -
Hitachi Energy TRO600 series products
TRO600 versions up to 9.2.1.6 are vulnerable to authenticated remote code execution via localhost service bypass and to unauthenticated arbitrary file read.
Read more → -
Siemens Mendix SAML Module
Versions of the Siemens Mendix SAML module prior to 4.2.4 (Mendix 10/11) and 3.6.29 (Mendix 9) are vulnerable to authentication bypass via SAML assertion replay.
Read more → -
Hitachi Energy CoreTec Product
CoreTec5 versions ≤3.4.0 and CoreTec4 versions ≤3.4.0 are vulnerable to OS command injection (CVE-2026-13162). Hitachi Energy recommends updating to CoreTec5 version 5.0.0.
Read more → -
ZDI-26-834: Linux Kernel IPv6 AH Routing Header Integer Underflow Local Privilege Escalation Vulnerability
An integer underflow in the IPv6 AH routing header handling can be exploited for local privilege escalation.
Read more → -
ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability
The issue is a use-after-free in the Linux kernel’s Logitech HIDPP protocol handling. It permits local privilege escalation after low-privileged code execution.
Read more → -
ZDI-26-836: Linux Kernel CIFS File System Use-After-Free Privilege Escalation Vulnerability
A use-after-free flaw in the Linux kernel CIFS file system driver enables local privilege escalation.
Read more → -
ZDI-26-837: Linux Kernel XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability
The advisory reports a use-after-free flaw in the Linux kernel XFRM subsystem that enables local privilege escalation.
Read more → -
ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability
The advisory reports a TTY race condition in the FreeBSD kernel that enables local privilege escalation.
Read more → -
ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
MLflow's PickleEvaluationArtifact can deserialize untrusted data, enabling remote code execution.
Read more → -
ZDI-26-840: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability
MLflow Tracking Server jobs can be accessed without proper authorization, leading to information disclosure.
Read more → -
ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
Remote authenticated attackers can elevate privileges on the MLflow Tracking Server.
Read more → -
ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
Remote attackers can achieve privilege escalation on MLflow Tracking Server after authenticating.
Read more → -
ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
MLflow's SHAP load_explainer function can deserialize untrusted data, enabling remote code execution.
Read more → -
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
MLflow’s get-artifacts endpoint is vulnerable to unauthenticated SSRF that can disclose sensitive information.
Read more → -
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability
MLflow's Statsmodels _load_model function deserializes untrusted data, enabling remote code execution when a user opens a malicious file or visits a crafted page.
Read more → -
ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability
MLflow's webhook server can be abused for server-side request forgery. Exploitation requires valid authentication.
Read more → -
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability
Authenticated remote attackers can trigger arbitrary server-side requests via MLflow’s AI Gateway (SSRF). The advisory assigns a CVSS score of 7.7.
Read more → -
CISA KEV — Broadcom VMWare ESX (CVE-2026-41709) +1 more
CISA added CVE-2026-41709 (Broadcom VMWare ESX) and CVE-2026-46300 (Linux kernel) to the KEV catalog. Both are reported as actively exploited.
Read more → -
ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability
Safari's jsToWasm IC entrypoint suffers a type-confusion that can be triggered via a malicious page.
Read more → -
ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability
The vulnerability is an out-of-bounds read in CoreText’s GDEF LigCaretList handling.
Read more → -
ZDI-26-832: AVG Internet Security avgToolsSvc Link Following Local Privilege Escalation Vulnerability
Local attackers can exploit avgToolsSvc link following to gain higher privileges on AVG Internet Security.
Read more → -
ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
Remote code execution is possible but requires authentication.
Read more → -
ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
Unauthenticated remote code execution via a stack-based buffer overflow in the Android Auto service stack of Alpine iLX-F511 devices.
Read more → -
ZDI-26-829: (0Day) (Pwn2Own) Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability
Heap-based buffer overflow in Bluetooth OBEX packet handling can be triggered without authentication. Exploitation requires the attacker to be physically near the device.
Read more → -
ZDI-26-812: (0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability
The torch_load function in Ultralytics deserializes untrusted data, enabling remote code execution when a user loads a malicious file or page.
Read more → -
ZDI-26-813: (0Day) Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability
The vulnerability is a code injection in Ultralytics' check_det_dataset function that can lead to remote code execution when a user visits a malicious page or opens a malicious file.
Read more → -
ZDI-26-814: (0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
Remote code execution requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-815: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
The advisory notes that exploitation requires the victim to load a malicious page or file. Successful exploitation can lead to remote code execution through the parse_model function.
Read more → -
ZDI-26-816: (0Day) Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability
The load_dataset_cache_file function in Ultralytics deserializes untrusted data, enabling remote code execution.
Read more → -
ZDI-26-817: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
Code injection in Ultralytics' parse_model function can lead to remote code execution, requiring the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability
Remote attackers can achieve code execution on Ultralytics installations via a Google Drive download path traversal.
Read more → -
ZDI-26-819: (0Day) (Pwn2Own) Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability
The advisory notes that Alpine iLX-F511 devices can be remotely compromised without authentication.
Read more → -
ZDI-26-820: (0Day) (Pwn2Own) Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability
The advisory reports a local privilege escalation vulnerability in Alpine iLX-F511 that requires prior low-privileged code execution.
Read more → -
ZDI-26-821: (0Day) (Pwn2Own) Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
A stack-based buffer overflow in the vCard parsing code can be triggered via Bluetooth on Alpine iLX-F511 devices.
Read more → -
ZDI-26-822: (0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
The advisory notes a stack-based buffer overflow in the Alpine iLX-F511 service stack that can be triggered without authentication. Exploitation requires the attacker to be physically present.
Read more → -
ZDI-26-823: (0Day) (Pwn2Own) Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability
A stack-based buffer overflow in prh_sdp_service_search_decode can be triggered via a paired Bluetooth device.
Read more → -
ZDI-26-824: (0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability
Unauthenticated remote code execution is possible on Alpine iLX-F511 devices via a network-adjacent attack.
Read more → -
ZDI-26-825: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability
Unauthenticated command injection can be triggered locally on Alpine iLX-F511 devices.
Read more → -
ZDI-26-826: (0Day) (Pwn2Own) Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability
The advisory reports an out-of-bounds read in libanwbtstack.so's prh_rfcomm_cc_process_test function, resulting in information disclosure. Exploitation requires pairing a malicious Bluetooth device.
Read more → -
ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability
The advisory notes a stack-based buffer overflow in the Android Auto Connection Handler of Alpine iLX-F511 devices.
Read more → -
CISA KEV — Adobe Commerce and Magento (CVE-2026-48356) +1 more
Adobe Commerce/Magento and Google Brotli have been added to CISA’s KEV catalog due to active exploitation.
Read more → -
EPICS Base
EPICS Base releases up to version 7.0.10 are affected by multiple critical vulnerabilities. The advisory provides a fix in version 7.0.11.
Read more → -
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Multiple Mitsubishi Electric industrial software products, including GENESIS64 and ICONICS Suite, are vulnerable in versions up to 10.97.3. The listed CVEs could enable code execution, authentication bypass, or denial-of-service.
Read more → -
ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability
Unauthenticated remote attackers can retrieve cleartext authentication data from MailEnable.
Read more → -
ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
MailEnable’s parseObjectResponse function is vulnerable to XML external entity processing that can disclose sensitive information.
Read more → -
CISA KEV — PHP Memory Corruption (CVE-2026-109618) +1 more
CISA added two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalog.
Read more → -
ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
Unauthenticated remote code execution is possible via an out-of-bounds write in libwebsockets' MQTT PUBACK handling.
Read more → -
ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution is possible via deserialization of untrusted data, but requires the victim to load a malicious page or file.
Read more → -
ZDI-26-794: Meta FAIRChem ion_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-795: Meta FAIRChem reaction_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution is possible via deserialization of untrusted data, but requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-796: Meta FAIRChem reaction adsorbate_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-797: Meta FAIRChem dense_eval dft-compute Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-798: Meta FAIRChem dense_eval results-file Deserialization of Untrusted Data Remote Code Execution Vulnerability
Deserialization of untrusted data in Meta FAIRChem dense_eval results files can lead to remote code execution when a user opens a malicious file or visits a malicious page.
Read more → -
ZDI-26-799: Meta FAIRChem Solvent Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-800: Meta FAIRChem OMolRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-801: Meta FAIRChem Slab Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-802: Meta FAIRChem process_mlrs Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution is possible via deserialization of untrusted data, but requires the victim to open a malicious page or file.
Read more → -
ZDI-26-803: Meta FAIRChem AdsorbMLRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability
Deserialization of untrusted data can lead to remote code execution, but requires the victim to load a malicious page or file.
Read more → -
ZDI-26-804: Meta FAIRChem Bulk Class Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to load a malicious page or file. Successful exploitation leads to remote code execution.
Read more → -
ZDI-26-805: Meta FAIRChem Adsorbate Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution can be triggered by deserialization of untrusted data, but requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-806: Meta FAIRChem write_top_k_vasp Deserialization of Untrusted Data Remote Code Execution Vulnerability
The write_top_k_vasp function deserializes untrusted data.
Read more → -
ZDI-26-807: Meta FAIRChem get_computational_df_to_predict Deserialization of Untrusted Data Remote Code Execution Vulnerability
Remote code execution requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-808: Meta FAIRChem run_validation Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to load a malicious page or file, leading to remote code execution via deserialization of untrusted data.
Read more → -
ZDI-26-809: Meta FAIRChem dense_eval dft-targets Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires the victim to visit a malicious page or open a malicious file.
Read more → -
ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability
The advisory notes a double-free in OpenUSD’s crate file parser that can be triggered remotely.
Read more → -
CISA KEV — Collabora Online – Built-in CODE Server (CVE-2026-110447)
CVE-2026-110447 in Collabora Online’s built-in CODE Server is now listed in CISA’s KEV catalog.
Read more → -
CISA KEV — Arista VeloCloud Orchestrator (CVE-2026-114625)
Arista VeloCloud Orchestrator has a SQL injection vulnerability (CVE-2026-114625) now listed in CISA’s KEV catalog.
Read more → -
Kiloview E3 NDI Encoder
Kiloview E3 firmware versions earlier than 1.30 are vulnerable. Exploitation could give an attacker full control of the device.
Read more → -
Siemens SIMATIC S7-1500 TM MFP
All versions of the SIMATIC S7-1500 TM MFP GNU/Linux subsystem are listed as vulnerable, with 377 CVSS-10 findings.
Read more → -
Siemens SENTRON 3NA COM Fuse
The advisory reports a denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse firmware versions earlier than 5.2.
Read more → -
Siemens SIMATIC S7 PLCs Web Server
All listed SIMATIC S7-1500 PLC models are affected by eight web-server vulnerabilities (CVE-2026-63350 through CVE-2026-63357).
Read more → -
Siemens Industrial Edge Devices
Multiple Siemens Industrial Edge devices have path-traversal flaws that allow an authenticated attacker to read internal files. Siemens has released updated firmware for several models.
Read more → -
Siemens SIMATIC IPCs
Siemens SIMATIC IPC models are vulnerable to a test key that can bypass UEFI Secure Boot.
Read more → -
Siemens RUGGEDCOM CROSSBOW Station Access Controller
SAC firmware versions earlier than 6.0 embed vulnerable SQLite code that may permit code execution or data leakage.
Read more → -
Siemens Software Center
Versions of Siemens Software Center earlier than 4.0.9.8 load DLLs from an uncontrolled search path.
Read more → -
Siemens PSS(R)SINCAL
The WibuKey driver used by Siemens PSS(R)SINCAL can cause an out-of-bounds write leading to a system crash when the legacy dongle license is configured.
Read more → -
InterSystems Corporation InterSystems IRIS for Health
InterSystems IRIS for Health versions 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221 ship with TLS/SSL disabled by default, exposing cleartext traffic. The advisory states an attacker could view transmitted data and use it to log into the device.
Read more → -
Siemens Capital Embedded AR Classic
An out-of-bounds read (CVE-2026-89208) affects Siemens Capital Embedded AR Classic 431-422 (all versions) and R20-11 versions earlier than V2303.
Read more → -
Siemens Industrial Edge Device Kit
Multiple arm64 versions of Siemens Industrial Edge Device Kit (V1.10-V1.25) contain path-traversal vulnerabilities (CVE-2026-44414, CVE-2026-44415). The flaws require authentication and could expose internal data.
Read more → -
Siemens WinCC
The advisory notes that WinCC versions prior to 8.0.0.11 and 8.1.7 are vulnerable to database privilege escalation.
Read more → -
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
The advisory notes 428 vulnerabilities in the GNU/Linux subsystem of firmware version ≥ 3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP.
Read more → -
Siemens Industrial Edge App Publisher
Versions of Siemens Industrial Edge App Publisher prior to 1.27.9 are vulnerable to certificate validation bypass and XSS that can enable remote code execution.
Read more → -
Siemens RUGGEDCOM APE1808 Devices
All Siemens RUGGEDCOM APE1808 devices are listed as affected by multiple CVEs.
Read more → -
Siemens RUGGEDCOM CROSSBOW
Versions of Siemens RUGGEDCOM CROSSBOW earlier than 6.0 are affected by multiple high-severity vulnerabilities. Siemens advises updating to version 6.0 or later.
Read more → -
Siemens APOGEE, TALON and Desigo PXC/PXM Products
All versions of Siemens APOGEE MBC and MEC devices are listed as vulnerable to four CVEs that may cause denial-of-service. Siemens advises updating to the latest firmware where fixes exist.
Read more → -
Siemens SIMATIC S7 Webserver API
Versions of the .NET Client Library for SIMATIC S7 Webserver API prior to 3.3.61 are vulnerable to path-traversal and information-leak flaws. Siemens advises updating to version 3.3.61 or newer.
Read more → -
Managing AI Token Consumption for Operational Resilience
Unmanaged AI token consumption can cause cost spikes, performance degradation, and denial-of-tokens attacks.
Read more → -
2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions
GitLab Community and Enterprise Editions contain a critical unauthenticated remote code execution flaw.
Read more → -
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
Unauthenticated remote code execution via a heap-based buffer overflow in NoMachine's nxwebrunner.
Read more → -
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
NVIDIA Megatron Bridge can execute arbitrary code when processing a malicious YAML file.
Read more → -
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
The advisory notes a stack-based buffer overflow in Snort’s OLE VBA decompression routine.
Read more → -
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
Unauthenticated remote attackers can trigger an externally-controlled format string in OpenSSL's CMP implementation to disclose sensitive information.
Read more → -
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
OpenSSL's CMS AuthEnvelopedData implementation fails to properly validate the integrity check value, enabling message tampering.
Read more → -
Critical Vulnerabilities in PHP Require Immediate Patching
CISA reports two PHP remote code execution flaws (CVE-2026-109618, CVE-2026-109619) that affect all PHP installations serving web traffic. The advisory recommends updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Read more → -
2026-018: Critical Vulnerabilities in PHP
Two remote-code-execution flaws have been disclosed in PHP, with patches slated for 21 Oct 2026. The advisory urges immediate patching or isolation of internet-facing PHP services.
Read more →
Page 1 of 13 · 1,260 advisories