Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
ZDI-26-727: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF or load a malicious page.
Read more → -
ZDI-26-728: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
The use-after-free leads to information disclosure, but exploitation requires user interaction.
Read more → -
ZDI-26-729: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader contains a use-after-free that can disclose information.
Read more → -
ZDI-26-730: Foxit PDF Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a malicious web page.
Read more → -
ZDI-26-731: Foxit PDF Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF file or visit a malicious web page.
Read more → -
ZDI-26-732: Foxit PDF Reader importIcon NTLM Response Information Disclosure Vulnerability
Foxit PDF Reader may disclose NTLM response data when processing a malicious page or file.
Read more → -
ZDI-26-733: Foxit PDF Reader Portfolio Directory Traversal Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a crafted web page.
Read more → -
ZDI-26-734: Foxit PDF Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
Foxit PDF Reader can be remotely compromised via a RichMedia annotation directory traversal that requires user interaction.
Read more → -
ZDI-26-735: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
A use-after-free in Foxit PDF Reader can disclose sensitive data.
Read more → -
ZDI-26-736: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
The advisory reports an out-of-bounds read in Foxit PDF Reader's PDF parsing that can disclose information.
Read more → -
ZDI-26-737: Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader can disclose sensitive data via an out-of-bounds read when parsing crafted JPEG files.
Read more → -
ZDI-26-738: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
The vulnerability is a use-after-free in Foxit PDF Reader’s annotation handling that can disclose information.
Read more → -
ZDI-26-739: Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader can be exploited via an out-of-bounds read to disclose information.
Read more → -
ZDI-26-740: Foxit PDF Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF file or visit a malicious web page.
Read more → -
ZDI-26-741: Foxit PDF Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
A network-adjacent attacker can achieve arbitrary code execution by convincing a user to open a malicious file or visit a malicious page.
Read more → -
ZDI-26-742: Foxit PDF Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability
The advisory notes a race condition in FoxitUpdater that can be leveraged for local privilege escalation.
Read more → -
ZDI-26-743: Foxit PDF Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability
Foxit PDF Reader can be remotely exploited via crafted JPEG2000 data when a user opens a malicious file or visits a malicious page.
Read more → -
ZDI-26-744: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a crafted PDF file or load a malicious webpage.
Read more → -
ZDI-26-745: Foxit PDF Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
The vulnerability is an out-of-bounds read in Foxit PDF Reader’s AcroForm handling.
Read more → -
ZDI-26-746: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious PDF file or visit a malicious page.
Read more → -
ZDI-26-747: Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability
Wireshark's RF4CE packet parser contains a buffer overflow that can lead to remote code execution when a user opens a crafted page or file.
Read more → -
ZDI-26-748: Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
KeyShot’s BIP file parser does not validate search-path elements, enabling remote code execution when a crafted file is opened.
Read more → -
2026-013: Critical Vulnerability in F5 BIG-IP APM
F5 BIG-IP APM is affected by a vulnerability that is being exploited.
Read more → -
CISA KEV — Check Point Multiple Products (CVE-2026-85102) +3 more
Four CVEs affecting Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM have been added to the KEV catalog. The catalog addition signals active exploitation of these flaws.
Read more → -
lwIP TCP/IP Stack MQTT Client Application
lwIP MQTT Client Application versions 2.0.1 through 2.2.1 are vulnerable to an out-of-bounds write.
Read more → -
Siemens Siveillance Control
The OIS web module in Siemens Siveillance Control permits arbitrary file upload, which can lead to root-level compromise. Siemens provides patches that update the OIS component to fixed versions.
Read more → -
Siemens SIMOVE Fleetmanager and SIPLANT
Siemens SIMOVE Fleetmanager and SIPLANT are vulnerable to a relative path-traversal flaw (CVE-2026-67367). Siemens has published newer versions and advises updating to the latest releases.
Read more → -
Siemens Desigo CC family
Siemens Desigo CC V6 and V7 can execute embedded scripts in user-defined graphics, enabling client-side code execution.
Read more → -
Siemens SIPLUS and SIMATIC Products
Multiple Siemens SIPLUS and SIMATIC products are listed as vulnerable to CVE-2026-31431. Siemens has released newer software versions and advises updating to the latest releases.
Read more → -
Siemens WTV676 and WTV776
Unauthenticated attackers can force the devices into protection mode, disabling web access. Siemens advises updating to the latest Web Interface versions.
Read more → -
lwIP (Lightweight IP)
lwIP versions 2.0.1 through 2.2.1 are affected by a double-free vulnerability (CVE-2026-91018).
Read more → -
OpenPLC Runtime v3
OpenPLC Runtime v3 (CVE-2026-88020) is vulnerable to a reflected XSS that can hijack session cookies and issue state-changing requests. The vendor has declared v3 end-of-life and advises upgrading to v4.
Read more → -
Siemens Industrial Edge Management
Siemens Industrial Edge Management versions prior to 1.15.20, 2.2.2, and 2.9.1 are vulnerable to an unauthenticated credential reset (CVE-2026-18963). Siemens recommends updating to the latest releases to remediate the issue.
Read more → -
ZDI-26-719: Cisco ThousandEyes Virtual Appliance DHCP Client Command Injection Remote Code Execution Vulnerability
Remote code execution is possible on Cisco ThousandEyes Virtual Appliance. Exploitation requires authentication.
Read more → -
CISA KEV — Zyxel GS1900 Series Switches (CVE-2026-7273)
CVE-2026-7273 is a stack-based buffer overflow in Zyxel GS1900 series switches added to CISA's KEV catalog.
Read more → -
CISA KEV — Linux Kernel (CVE-2025-39682)
CISA added CVE-2025-39682, a Linux kernel improper-check vulnerability, to the KEV catalog. The flaw is actively exploited and prioritized for rapid remediation.
Read more → -
CISA KEV — Linux Kernel (CVE-2025-39964) +1 more
CISA added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to the KEV Catalog due to active exploitation.
Read more → -
ZDI-26-715: Linux Mint Xreader PDF File Parsing Type Confusion Remote Code Execution Vulnerability
Xreader can be remotely compromised via a crafted PDF file. Exploitation requires the victim to open the malicious file or visit a malicious page.
Read more → -
ZDI-26-716: Cisco Identity Services Engine createDBLink Command Injection Remote Code Execution Vulnerability
The createDBLink command in Cisco Identity Services Engine is vulnerable to command injection, requiring authentication for exploitation.
Read more → -
ZDI-26-717: Cisco Identity Services Engine AlarmMessageDiskQueue Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires valid authentication credentials.
Read more → -
ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability
The issue exploits XML external entity processing in the MnTRESTLivelogService to disclose data after authentication.
Read more → -
ABB Ability Edgenius
ABB Ability Edgenius versions 3.2.0.0 through 3.2.4.0 are listed as affected by CVE-2026-31431. ABB provides an update to version 3.2.4.1 that resolves the issue.
Read more → -
Schneider Electric PowerChute Serial Shutdown
Versions ≤1.5 and 1.6 of PowerChute Serial Shutdown are vulnerable to CVE-2026-13348.
Read more → -
Schneider Electric Modicon M340 Controller and Communication Modules
The advisory reports a denial-of-service vulnerability in Schneider Electric Modicon M340 controllers and several communication modules.
Read more → -
Schneider Electric NetBotz 5 750/755
NetBotz 5 750/755 devices running firmware 5.5.2 or earlier are vulnerable to OS command injection and Hibernate SQL injection.
Read more → -
Bransys ELD
Bransys ELD versions prior to Android 11.00.00 and iOS 1.1.54 contain hard-coded MQTT credentials and transmit data in cleartext. These flaws could let an attacker read telemetry data and firmware.
Read more → -
Hitachi Energy FACTS Control Platform (FCP)
Hitachi Energy FACTS Control Platform versions 3.4.0 through 4.1.1 with the GWS component are vulnerable, scoring 9.9 CVSS.
Read more → -
Mitsubishi Electric GX Works3 and Motion Control Settings
All versions of Mitsubishi Electric GX Works3 and Motion Control Settings are affected by CVE-2026-15688. A local attacker can bypass the block password and modify the program memory.
Read more → -
ZDI-26-714: Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability
A stack-based buffer overflow in Samsung rlottie enables remote code execution.
Read more → -
CISA KEV — Cisco Identity Services Engine (CVE-2026-76460) +1 more
Cisco Identity Services Engine and Acronis Backup have been added to CISA’s Known Exploited Vulnerabilities catalog.
Read more → -
Using Cyber Decoys to Strengthen Detection and Response
Cyber decoys provide high-fidelity alerts that can reveal adversaries using legitimate credentials and living-off-the-land tools.
Read more → -
CISA KEV — Google Pixel (CVE-2026-58704)
CISA added CVE-2026-58704, an improper authorization vulnerability affecting Google Pixel devices, to its Known Exploited Vulnerabilities catalog.
Read more → -
ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability
Unauthenticated remote code execution via CommandSinkRmi deserialization in Cisco Secure Firewall Management Center.
Read more → -
ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
Unauthenticated remote code execution via a heap-based buffer overflow in NoMachine's mDNS handling.
Read more → -
ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
The vulnerability permits local privilege escalation on NoMachine installations via improper authentication in the Redis component.
Read more → -
ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
Unauthenticated attackers can exploit an SSRF flaw in NoMachine’s nxhtd service to issue arbitrary server-side requests.
Read more → -
ZDI-26-713: GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GIMP's APNG parser contains a stack-based buffer overflow.
Read more → -
ZDI-26-703: (0Day) Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
The Airbyte SharePoint connector’s _get_shared_drive_object endpoint can be abused for SSRF.
Read more → -
ZDI-26-704: (0Day) Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
Airbyte's OneDrive connector can be abused for SSRF when authenticated.
Read more → -
ZDI-26-705: (0Day) BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
BusyBox's libarchive component can be abused via a symlink directory traversal to create arbitrary files.
Read more → -
ZDI-26-706: (0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
Remote attackers can execute code by loading a malicious agent configuration.
Read more → -
ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
Remote code execution is possible on MindsDB OpenBBtable installations, but exploitation requires authentication.
Read more → -
ZDI-26-708: (0Day) Microsoft Windows HTTP Proxy Privilege Escalation Vulnerability
Local privilege escalation via the Windows HTTP Proxy component.
Read more → -
CareCam CM2507
CareCam CM2507 firmware v251211.1507 lacks authentication for its video streaming service, permitting unauthenticated retrieval of live video.
Read more → -
Siemens Reyrolle 7SR5
Versions of Siemens Reyrolle 7SR5 earlier than V2.70 contain multiple high-severity vulnerabilities. Siemens provides an update to V2.70 or later.
Read more → -
Wärtsilä FOS-Onboard
Wärtsilä FOS-Onboard version 5.07.0923.01 contains hard-coded cryptographic keys. Wärtsilä has released a security patch for the issue.
Read more → -
Siemens Mendix SAML
Versions of Siemens Mendix SAML earlier than 4.2.3 (Mendix 10/11) or 3.6.27 (Mendix 9.24) are vulnerable to CVE-2026-80465. The flaw allows unauthenticated remote attackers to hijack a user session in specific SSO configurations.
Read more → -
Siemens Teamcenter
A reflected cross-site scripting vulnerability exists in the /auth/ redirect flow of Siemens Teamcenter.
Read more → -
Schneider Electric SCADAPack x70 Products
All listed SCADAPack x70 models are affected by CVE-2026-81861. The advisory recommends using RBAC instead of the Secure Lock feature.
Read more → -
mySCADA myPRO Manager
Versions ≤ 2.1 of mySCADA myPRO Manager lack authentication for privileged functions, allowing unauthenticated access.
Read more → -
Digital Watchdog VMAX DVR and NVR Product Lineups
All firmware versions of Digital Watchdog VMAX DVR and NVR models are listed as vulnerable. The vulnerabilities could give an unauthenticated attacker full administrative control.
Read more → -
Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
The report advises agencies and cloud providers to inventory and secure token validation and secret management processes. It emphasizes detection at scale for token misuse.
Read more → -
CISA KEV — Cisco Secure Email Gateway (CVE-2026-76461)
CVE-2026-76461 is a SQL injection vulnerability in Cisco Secure Email Gateway now listed in CISA’s KEV catalog.
Read more → -
ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability
A use-after-free in the Linux kernel crypto subsystem enables local privilege escalation.
Read more → -
ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability
A race condition in the Linux kernel FUSE subsystem permits local privilege escalation.
Read more → -
ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability
Local exploitation requires high-privileged code execution to disclose information.
Read more → -
ZDI-26-683: Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability
The advisory reports a use-after-free flaw in the Linux kernel IPv6 VTI subsystem (CVE-2026-72463) with a CVSS score of 7.5.
Read more → -
ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability
Remote code execution is possible without authentication on Linux kernels with KSMBD enabled.
Read more → -
ZDI-26-685: Linux Kernel NFC NCI UART Driver Race Condition Local Privilege Escalation Vulnerability
A race condition in the Linux kernel NFC NCI UART driver can be used for local privilege escalation.
Read more → -
ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability
A race condition in the nftables subsystem of the Linux kernel enables local privilege escalation.
Read more → -
ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability
A use-after-free in the Linux kernel's Open vSwitch flow-delete path can disclose kernel memory to a local low-privileged attacker.
Read more → -
ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability
The vulnerability is a race condition in the Linux kernel's OpenvSwitch component that enables local privilege escalation.
Read more → -
ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability
A race condition in the Linux kernel SCTP subsystem can disclose information to a local low-privileged attacker.
Read more → -
ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
Local attackers can read sensitive data if they have high-privileged code execution on the target Linux kernel.
Read more → -
ZDI-26-691: Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability
Integer overflow in the Linux kernel netlink-based wireless configuration can lead to local privilege escalation. Exploitation requires the attacker to have already executed code with high privileges.
Read more → -
ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability
The vulnerability is a race condition in the eMPIA USB device driver that allows physically present attackers to execute arbitrary code.
Read more → -
ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability
Only Linux kernels with ksmbd enabled are vulnerable, and exploitation requires authentication.
Read more → -
ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability
The advisory reports a use-after-free in the Linux kernel’s net scheduler clsact qdisc. It enables local privilege escalation.
Read more → -
ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability
The vulnerability allows remote attackers to execute arbitrary code on Linux Kernel installations with nfsd enabled, but authentication is required.
Read more → -
ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability
Local low-privilege code can trigger a heap-based overflow in the NTFS3 journal handling.
Read more → -
ZDI-26-697: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
The NTFS3 driver in the Linux kernel has an out-of-bounds read that can disclose kernel memory.
Read more → -
ZDI-26-698: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
The vulnerability is an out-of-bounds read in the Linux kernel's NTFS3 driver.
Read more → -
ZDI-26-699: Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerability
The NTFS3 driver in the Linux kernel contains an out-of-bounds read that can disclose kernel memory.
Read more → -
ZDI-26-700: Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability
The advisory reports a use-after-free bug in the Linux kernel’s QFQ Plus scheduler that enables local privilege escalation.
Read more → -
ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability
The vulnerability permits local attackers to read sensitive data from the Linux kernel after obtaining high-privileged execution. It is identified as CVE-2026-64046.
Read more → -
ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability
The vulnerability allows physically present attackers to elevate privileges on affected Linux Kernel installations. Authentication is not required to exploit.
Read more → -
CISA KEV — GitLab Community Edition and Enterprise Edition (CVE-2026-85706)
GitLab Community Edition and Enterprise Edition are listed in the KEV catalog for an actively exploited path-traversal flaw (CVE-2026-85706).
Read more → -
CISA KEV — JFrog Artifactory (CVE-2026-42016) +2 more
CISA added two JFrog Artifactory and one ConnectWise ScreenConnect CVEs to the KEV Catalog. The advisory notes they are actively exploited.
Read more → -
CISA KEV — MikroTik RouterOS (CVE-2026-67277) +1 more
CISA added two MikroTik RouterOS vulnerabilities to its KEV catalog.
Read more → -
AVEVA Pipeline Integrity Monitor
Versions of AVEVA Pipeline Integrity Monitor up to 2025 SP1 P1 build 7.1.9580.8513 are affected.
Read more →
Page 2 of 12 · 1,153 advisories