Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
Hitachi Energy RTU500
RTU500 series CMU firmware versions 11.x and earlier are identified as vulnerable. These versions are end-of-life and no longer receive security updates.
Read more → -
Savannah lwIP SMTP client
The advisory reports a buffer overflow in Savannah lwIP SMTP client 2.2.1. A patch (patch_125_smtp_txbuf.diff) has been released.
Read more → -
Hitachi Energy SOI
SOI versions 2.0.0-2.2.0 contain an ActiveMQ code-injection flaw (CVE-2026-34197).
Read more → -
Johnson Controls EasyIO FG
EasyIO FG firmware up to version 2.0b52 contains hard-coded credentials and lacks a patch because the product is end-of-life. No firmware update will be released.
Read more → -
Hitachi Energy Asset Suite
Asset Suite versions 9.9.0 and earlier allow unauthenticated access to the HTTPPublishAdapterTestServlet. Upgrade to 9.9.1 or disable the servlet to mitigate.
Read more → -
Hitachi Energy REB500
REB500 versions 8.3.3.1 and earlier are vulnerable to denial-of-service via libexpat flaws.
Read more → -
CISA KEV — Citrix NetScaler (CVE-2026-88779)
CVE-2026-88779 targets Citrix NetScaler appliances and is listed as a known exploited vulnerability.
Read more → -
CISA KEV — Zammad GmbH Zammad Session Fixation (CVE-2026-102489) +1 more
CISA added CVE-2026-102489 and CVE-2026-102490 for Zammad to the KEV Catalog, indicating active exploitation.
Read more → -
CISA KEV — Fortinet FortiMail (CVE-2026-104286)
FortiMail path traversal vulnerability (CVE-2026-104286) has been added to CISA’s KEV catalog.
Read more → -
CISA Malcolm
Versions of CISA Malcolm earlier than 26.06.0 are listed as affected. The advisory reports that unauthenticated attackers can craft links that execute arbitrary script.
Read more → -
Johnson Controls EasyIO Neo Series EC and CW Controllers
Versions V3.3b62, V3.3b63, V3.3b24, and V3.3b25 transmit credentials and session data in cleartext.
Read more → -
ABB Protection and Control IED Manager PCM600
PCM600 versions up to 2.14 permit local users to elevate privileges via the Scheduler Service.
Read more → -
Meari IoT Cloud Platform OpenAPI Service
All versions of Meari IoT Cloud Platform OpenAPI Service are affected by missing-authorization vulnerabilities.
Read more → -
Johnson Controls EasyIO Neo Series EC and CW Controllers
Firmware versions V3.3b62, V3.3b63 (EC) and V3.3b24, V3.3b25 (CW) are identified as vulnerable.
Read more → -
Monta monta.app
All versions of Monta monta.app are affected. Unauthenticated WebSocket endpoints allow attackers to impersonate charging stations.
Read more → -
Armatura LLC Armatura One
Armatura One versions prior to 4.7.2 expose an unauthenticated ActiveMQ OpenWire listener.
Read more → -
ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
The advisory reports a TOCTOU privilege escalation flaw in the Windows dxgkrnl driver.
Read more → -
CISA Adds One Known Exploited Vulnerability to Catalog
Cisco Catalyst SD-WAN Manager is listed in CISA’s KEV catalog due to active exploitation of CVE-2026-76504.
Read more → -
ZDI-26-749: WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires write access to the samld session directory.
Read more → -
ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability
Remote code execution is possible via a stack-based buffer overflow in WatchGuard FireWare OS's spamd statushdlr, but authentication is required.
Read more → -
CISA KEV — Apple Multiple Products (CVE-2026-86950)
CISA added CVE-2026-86950, an out-of-bounds write bug affecting multiple Apple products, to the KEV catalog. The advisory urges rapid remediation on publicly exposed assets.
Read more → -
Lantronix G520 Series Cellular Gateway
Lantronix G520 Series Cellular Gateway version 2.6.0.4R6_stable is vulnerable to remote code execution via its update mechanism.
Read more → -
Toptech TMS7 and TopHAT
Toptech TMS7 and TopHAT version 7.6.3 are vulnerable to unauthenticated database export. The vendor released version 7.8 that resolves the issues.
Read more → -
Viidure Dashcam Android Application
The advisory reports that the dashcam platform’s cloud storage bucket is publicly readable, exposing user data and firmware.
Read more → -
Anjvision YSSD-RTMP-H5
Firmware 3.3.2.4_build_2024-12-26 of the Anjvision YSSD-RTMP-H5 is listed as affected.
Read more → -
VIVOTEK Camera Firmware
Remote command execution with root privileges is possible on the listed VIVOTEK camera firmware versions.
Read more → -
MikroTik RouterOS
RouterOS versions prior to 7.24 contain an unauthenticated integer underflow in the web management service.
Read more → -
Baicells Nova 430H
Unauthenticated devices within radio range can send malformed uplink messages that may cause a denial-of-service condition on the eNodeB. The issue affects Nova 430H eNodeB firmware versions up to BaiBLQ_3.0.12.
Read more → -
2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
Two unauthenticated RCE vulnerabilities in Citrix NetScaler ADC and Gateway are confirmed to be exploited in the wild.
Read more → -
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
CVE-2026-88771 and CVE-2026-88772 are critical zero-day flaws in Citrix NetScaler ADC and Gateway that enable remote code execution.
Read more → -
CISA KEV — Citrix NetScaler (CVE-2026-88771) +1 more
Two Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) have been added to CISA’s Known Exploited Vulnerabilities catalog.
Read more → -
CISA KEV — WordPress Core Remote File Inclusion (CVE-2026-87902)
WordPress core versions vulnerable to CVE-2026-87902 have been added to CISA’s KEV catalog. The vulnerability is a remote file inclusion that is actively exploited.
Read more → -
CISA KEV — Microsoft SharePoint (CVE-2026-65660) +1 more
Microsoft SharePoint and Mikrotik RouterOS have been added to the KEV catalog due to active exploitation.
Read more → -
CISA KEV — WSO2 Multiple Products (CVE-2026-5430) +1 more
CISA added CVE-2026-5430 (WSO2 path-traversal) and CVE-2026-71362 (Adobe Commerce/Magento incorrect-authorization) to its KEV Catalog.
Read more → -
Eufy Omni C20, Omni X10 Pro
Versions earlier than 1.6.4 of the Eufy Omni C20 and Omni X10 Pro are vulnerable to command injection and hard-coded credentials.
Read more → -
Botslab G980H Dashcams
Botslab G980H dashcams (firmware series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+) are identified as vulnerable. The advisory notes multiple CVEs allowing authentication bypass and device manipulation.
Read more → -
Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
The fact sheet advises applying the principle of least privilege to third-party ICS integrators.
Read more → -
ZDI-26-720: Foxit PDF Reader activeDocs Missing Authorization Information Disclosure Vulnerability
Foxit PDF Reader's activeDocs component can disclose sensitive information when a user opens a crafted file or visits a malicious page.
Read more → -
ZDI-26-721: Foxit PDF Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerability
An integer overflow in Foxit PDF Reader’s U3D parser can be triggered by opening a crafted PDF or visiting a malicious page.
Read more → -
ZDI-26-722: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF or visit a malicious webpage.
Read more → -
ZDI-26-723: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a crafted web page.
Read more → -
ZDI-26-724: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
The vulnerability is a use-after-free in Foxit PDF Reader’s annotation handling that requires the victim to open a malicious PDF or visit a malicious page.
Read more → -
ZDI-26-725: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader contains a use-after-free that can disclose data, but exploitation requires a user to open a malicious PDF or visit a malicious page.
Read more → -
ZDI-26-726: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader contains a use-after-free information disclosure that requires user interaction.
Read more → -
ZDI-26-727: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF or load a malicious page.
Read more → -
ZDI-26-728: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
The use-after-free leads to information disclosure, but exploitation requires user interaction.
Read more → -
ZDI-26-729: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader contains a use-after-free that can disclose information.
Read more → -
ZDI-26-730: Foxit PDF Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a malicious web page.
Read more → -
ZDI-26-731: Foxit PDF Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF file or visit a malicious web page.
Read more → -
ZDI-26-732: Foxit PDF Reader importIcon NTLM Response Information Disclosure Vulnerability
Foxit PDF Reader may disclose NTLM response data when processing a malicious page or file.
Read more → -
ZDI-26-733: Foxit PDF Reader Portfolio Directory Traversal Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a crafted web page.
Read more → -
ZDI-26-734: Foxit PDF Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
Foxit PDF Reader can be remotely compromised via a RichMedia annotation directory traversal that requires user interaction.
Read more → -
ZDI-26-735: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
A use-after-free in Foxit PDF Reader can disclose sensitive data.
Read more → -
ZDI-26-736: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
The advisory reports an out-of-bounds read in Foxit PDF Reader's PDF parsing that can disclose information.
Read more → -
ZDI-26-737: Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader can disclose sensitive data via an out-of-bounds read when parsing crafted JPEG files.
Read more → -
ZDI-26-738: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
The vulnerability is a use-after-free in Foxit PDF Reader’s annotation handling that can disclose information.
Read more → -
ZDI-26-739: Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader can be exploited via an out-of-bounds read to disclose information.
Read more → -
ZDI-26-740: Foxit PDF Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF file or visit a malicious web page.
Read more → -
ZDI-26-741: Foxit PDF Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
A network-adjacent attacker can achieve arbitrary code execution by convincing a user to open a malicious file or visit a malicious page.
Read more → -
ZDI-26-742: Foxit PDF Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability
The advisory notes a race condition in FoxitUpdater that can be leveraged for local privilege escalation.
Read more → -
ZDI-26-743: Foxit PDF Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability
Foxit PDF Reader can be remotely exploited via crafted JPEG2000 data when a user opens a malicious file or visits a malicious page.
Read more → -
ZDI-26-744: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF file or load a malicious webpage.
Read more → -
ZDI-26-745: Foxit PDF Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
The vulnerability is an out-of-bounds read in Foxit PDF Reader’s AcroForm handling.
Read more → -
ZDI-26-746: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a malicious page.
Read more → -
ZDI-26-747: Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability
Wireshark's RF4CE packet parser contains a buffer overflow that can lead to remote code execution when a user opens a crafted page or file.
Read more → -
ZDI-26-748: Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
KeyShot’s BIP file parser does not validate search-path elements, enabling remote code execution when a crafted file is opened.
Read more → -
2026-013: Critical Vulnerability in F5 BIG-IP APM
F5 BIG-IP APM is affected by a vulnerability that is being exploited.
Read more → -
CISA KEV — Check Point Multiple Products (CVE-2026-85102) +3 more
Four CVEs affecting Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM have been added to the KEV catalog. The catalog addition signals active exploitation of these flaws.
Read more → -
lwIP TCP/IP Stack MQTT Client Application
lwIP MQTT Client Application versions 2.0.1 through 2.2.1 are vulnerable to an out-of-bounds write.
Read more → -
Siemens Siveillance Control
The OIS web module in Siemens Siveillance Control permits arbitrary file upload, which can lead to root-level compromise. Siemens provides patches that update the OIS component to fixed versions.
Read more → -
Siemens SIMOVE Fleetmanager and SIPLANT
Siemens SIMOVE Fleetmanager and SIPLANT are vulnerable to a relative path-traversal flaw (CVE-2026-67367). Siemens has published newer versions and advises updating to the latest releases.
Read more → -
Siemens Desigo CC family
Siemens Desigo CC V6 and V7 can execute embedded scripts in user-defined graphics, enabling client-side code execution.
Read more → -
Siemens SIPLUS and SIMATIC Products
Multiple Siemens SIPLUS and SIMATIC products are listed as vulnerable to CVE-2026-31431. Siemens has released newer software versions and advises updating to the latest releases.
Read more → -
Siemens WTV676 and WTV776
Unauthenticated attackers can force the devices into protection mode, disabling web access. Siemens advises updating to the latest Web Interface versions.
Read more → -
lwIP (Lightweight IP)
lwIP versions 2.0.1 through 2.2.1 are affected by a double-free vulnerability (CVE-2026-91018).
Read more → -
OpenPLC Runtime v3
OpenPLC Runtime v3 (CVE-2026-88020) is vulnerable to a reflected XSS that can hijack session cookies and issue state-changing requests. The vendor has declared v3 end-of-life and advises upgrading to v4.
Read more → -
Siemens Industrial Edge Management
Siemens Industrial Edge Management versions prior to 1.15.20, 2.2.2, and 2.9.1 are vulnerable to an unauthenticated credential reset (CVE-2026-18963). Siemens recommends updating to the latest releases to remediate the issue.
Read more → -
ZDI-26-719: Cisco ThousandEyes Virtual Appliance DHCP Client Command Injection Remote Code Execution Vulnerability
Remote code execution is possible on Cisco ThousandEyes Virtual Appliance. Exploitation requires authentication.
Read more → -
CISA KEV — Zyxel GS1900 Series Switches (CVE-2026-7273)
CVE-2026-7273 is a stack-based buffer overflow in Zyxel GS1900 series switches added to CISA's KEV catalog.
Read more → -
CISA KEV — Linux Kernel (CVE-2025-39682)
CISA added CVE-2025-39682, a Linux kernel improper-check vulnerability, to the KEV catalog. The flaw is actively exploited and prioritized for rapid remediation.
Read more → -
CISA KEV — Linux Kernel (CVE-2025-39964) +1 more
CISA added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to the KEV Catalog due to active exploitation.
Read more → -
ZDI-26-715: Linux Mint Xreader PDF File Parsing Type Confusion Remote Code Execution Vulnerability
Xreader can be remotely compromised via a crafted PDF file. Exploitation requires the victim to open the malicious file or visit a malicious page.
Read more → -
ZDI-26-716: Cisco Identity Services Engine createDBLink Command Injection Remote Code Execution Vulnerability
The createDBLink command in Cisco Identity Services Engine is vulnerable to command injection, requiring authentication for exploitation.
Read more → -
ZDI-26-717: Cisco Identity Services Engine AlarmMessageDiskQueue Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires valid authentication credentials.
Read more → -
ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability
The issue exploits XML external entity processing in the MnTRESTLivelogService to disclose data after authentication.
Read more → -
ABB Ability Edgenius
ABB Ability Edgenius versions 3.2.0.0 through 3.2.4.0 are listed as affected by CVE-2026-31431. ABB provides an update to version 3.2.4.1 that resolves the issue.
Read more → -
Schneider Electric PowerChute Serial Shutdown
Versions ≤1.5 and 1.6 of PowerChute Serial Shutdown are vulnerable to CVE-2026-13348.
Read more → -
Schneider Electric Modicon M340 Controller and Communication Modules
The advisory reports a denial-of-service vulnerability in Schneider Electric Modicon M340 controllers and several communication modules.
Read more → -
Schneider Electric NetBotz 5 750/755
NetBotz 5 750/755 devices running firmware 5.5.2 or earlier are vulnerable to OS command injection and Hibernate SQL injection.
Read more → -
Bransys ELD
Bransys ELD versions prior to Android 11.00.00 and iOS 1.1.54 contain hard-coded MQTT credentials and transmit data in cleartext. These flaws could let an attacker read telemetry data and firmware.
Read more → -
Hitachi Energy FACTS Control Platform (FCP)
Hitachi Energy FACTS Control Platform versions 3.4.0 through 4.1.1 with the GWS component are vulnerable, scoring 9.9 CVSS.
Read more → -
Mitsubishi Electric GX Works3 and Motion Control Settings
All versions of Mitsubishi Electric GX Works3 and Motion Control Settings are affected by CVE-2026-15688. A local attacker can bypass the block password and modify the program memory.
Read more → -
ZDI-26-714: Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability
A stack-based buffer overflow in Samsung rlottie enables remote code execution.
Read more → -
CISA KEV — Cisco Identity Services Engine (CVE-2026-76460) +1 more
Cisco Identity Services Engine and Acronis Backup have been added to CISA’s Known Exploited Vulnerabilities catalog.
Read more → -
Using Cyber Decoys to Strengthen Detection and Response
Cyber decoys provide high-fidelity alerts that can reveal adversaries using legitimate credentials and living-off-the-land tools.
Read more → -
CISA KEV — Google Pixel (CVE-2026-58704)
CISA added CVE-2026-58704, an improper authorization vulnerability affecting Google Pixel devices, to its Known Exploited Vulnerabilities catalog.
Read more → -
ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability
Unauthenticated remote code execution via CommandSinkRmi deserialization in Cisco Secure Firewall Management Center.
Read more → -
ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
Unauthenticated remote code execution via a heap-based buffer overflow in NoMachine's mDNS handling.
Read more → -
ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
The vulnerability permits local privilege escalation on NoMachine installations via improper authentication in the Redis component.
Read more → -
ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
Unauthenticated attackers can exploit an SSRF flaw in NoMachine’s nxhtd service to issue arbitrary server-side requests.
Read more →
Page 1 of 11 · 1,097 advisories