Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
Tycon Systems TPDIN-Monitor-WEB3
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and earlier are vulnerable. Tycon provides firmware v2.4.2 to remediate the issues.
Read more → -
OPCFoundation OPC UA LocalDiscoveryServer (LDS)
OPCFoundation OPC UA LocalDiscoveryServer installers earlier than version 1.04.420 are vulnerable to privilege escalation during installation.
Read more → -
Inductive Automation Ignition
Versions 8.1.53 and earlier of Inductive Automation Ignition allow any authenticated user to create projects because the default "Create Project Role(s)" setting is blank. The issue is resolved in version 8.1.54 and later.
Read more → -
Rockwell Automation 1756-ENBT Module
All versions of the Rockwell Automation 1756-ENBT module are vulnerable to a crafted CIP packet that can cause a crash.
Read more → -
Preparing for the Post-Quantum Era: A Call to Action
CISA and the G7 Cyber Security Working Group issue a call to begin transitioning to post-quantum cryptography.
Read more → -
CISA KEV — Sangoma Switchvox (CVE-2026-9586) +6 more
CISA added seven actively exploited CVEs to its KEV catalog, covering Switchvox, Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances.
Read more → -
Communicating Under Pressure: Best Practices for Service Providers
The advisory offers communication best-practice guidance for service providers during IT and OT outages.
Read more → -
Rockwell Automation FactoryTalk Activation Manager
FactoryTalk Activation Manager versions 5.02 and earlier are vulnerable to privilege escalation via installer console windows.
Read more → -
Rockwell Automation Redundancy Module Configuration Tool
The advisory identifies a DLL search-path permission issue in Rockwell Automation’s Redundancy Module Configuration Tool versions 9.00.00 through 10.00.00.
Read more → -
Rockwell Automation Logix Platform
The advisory lists specific Logix firmware versions that are vulnerable to a denial-of-service condition. Exploitation can cause a major nonrecoverable fault requiring a power cycle.
Read more → -
Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix
ControlLogix, CompactLogix, GuardLogix and Compact GuardLogix controllers with firmware below 34.015 (and related patch levels) are vulnerable to a denial-of-service condition. The flaw can trigger a major non-recoverable fault that requires a program download or a stage-2 reset to recover.
Read more → -
Rockwell Automation Historian ME
Series B 5.202 and Series C 7.101 of Rockwell Automation Historian ME are listed as vulnerable.
Read more → -
Rockwell Automation RSLinx Classic
RSLinx Classic versions up to 4.50 are vulnerable to denial-of-service via malformed CIP packets.
Read more → -
CISA KEV — PaperCut NG/MF (CVE-2026-81578) +1 more
PaperCut NG/MF is listed with two KEV vulnerabilities (CVE-2026-81578 and CVE-2026-82078).
Read more → -
CISA KEV — ownCloud (CVE-2023-49105) +2 more
CISA added CVE-2023-49105 (ownCloud), CVE-2026-53362 (Linux kernel) and CVE-2026-66384 (JFrog Artifactory) to the KEV Catalog.
Read more → -
Mitsubishi Electric CNC Series (Update A)
The advisory lists multiple Mitsubishi Electric CNC models (Update A) as vulnerable to CVE-2025-2399. Exploitation may cause an out-of-bounds read leading to denial-of-service.
Read more → -
Xiiaozet LK100W
Xiiaozet LK100W devices with firmware earlier than 2.1.240 are vulnerable to OS command injection and unauthenticated management functions.
Read more → -
Rockwell Automation OTTO Fleet Manager
OTTO Fleet Manager versions up to 2.36.2 use a low bcrypt work factor, easing offline password-hash cracking.
Read more → -
Ebyte NA111-M
The NA111-M firmware 9013-2-17 is listed as affected by multiple high-severity CVEs.
Read more → -
All-Line Equipment Company Fuel-Boss
Fuel-Boss V1 products running PHP 7.1.5 are vulnerable to remote command execution via crafted IMAP server names.
Read more → -
Applied Systems Engineering ASE2000 V2 Communications Test Set
ASE2000 V2 Communications Test Set versions 2.25-2.37 are vulnerable to XML external entity attacks and improper TLS certificate validation. The vendor recommends upgrading to version 2.38.
Read more → -
Mitsubishi Electric Multiple FA Products (Update D)
A crafted UDP packet can cause denial-of-service, timeout, or communication delay on Mitsubishi CC-Link IE TSN Remote I/O modules version ≤ 09.
Read more → -
CISA KEV — Red Hat Libuser (CVE-2015-3246) +5 more
CISA added six actively exploited CVEs to its KEV Catalog, including a Citrix NetScaler ADC buffer vulnerability.
Read more → -
CISA Vulnerability Review
CISA notes that most compromises stem from exposed, well-known software flaws rather than advanced techniques. It advises using the BOD 26-04 risk-based framework to prioritize remediation.
Read more → -
Bendix EC80 Brake ECU
A stack-based buffer overflow in the Bendix EC80 Brake ECU could allow remote code execution on the CAN bus.
Read more → -
FURUNO FA-50 Class B AIS Transponder
All versions of the FURUNO FA-50 Class B AIS Transponder are affected by hard-coded credentials and missing authentication for critical functions.
Read more → -
Siemens SIMATIC IoT2050 Advanced
Unauthenticated attackers can create malicious Node-RED flows via the HTTP interface. Siemens recommends updating to firmware version 4.3.4.1 or later.
Read more → -
Zoneminder
An authenticated user with View Events permission can exploit an OS command injection via the exportFile parameter.
Read more → -
PayRange API
All versions of the PayRange API are missing proper authorization on management endpoints. This permits unauthenticated disclosure, modification, or denial-of-service of device data.
Read more → -
Rently Smart Home
Rently Smart Home versions up to 20.1.0 are affected by CVE-2026-75960, an insufficiently protected credentials flaw.
Read more → -
Ebyte NE2-D11
The NE2-D11 firmware FW-9167-0-11 does not enforce authentication on its web management interface.
Read more → -
CISA KEV — Gitea (CVE-2026-60004)
CVE-2026-60004, a code injection flaw in Gitea, has been added to CISA’s KEV catalog.
Read more → -
A Tale of Two SOCs: Insights From Two Red Team Assessments
CISA conducted red team assessments at two organizations, observing different defensive outcomes. One organization failed to detect or contain the red team's activity, while the other rapidly identified and isolated initial compromise attempts.
Read more → -
CISA KEV — Oracle HTTP Server and Oracle Weblogic (CVE-2026-21962)
CISA added CVE-2026-21962, an improper access-control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to the KEV catalog. The vulnerability is being actively exploited.
Read more → -
CISA KEV — Zimbra Collaboration Suite (ZCS) (CVE-2026-73570)
CISA added CVE-2026-73570, an OS command injection in Zimbra Collaboration Suite, to the KEV catalog.
Read more → -
CISA KEV — TrueConf Server (CVE-2026-72529) +1 more
CISA added CVE-2026-72529 and CVE-2026-72530 to its KEV Catalog due to evidence of active exploitation. These vulnerabilities affect TrueConf Server.
Read more → -
Johnson Controls Simplex Incident Manager
Simplex Incident Manager versions up to V2.01 store user credentials in cleartext memory.
Read more → -
CISA KEV — MLflow (CVE-2026-64849)
CVE-2026-64849, an SSRF flaw in MLflow, has been added to CISA’s KEV catalog due to active exploitation.
Read more → -
Defending Against an Active Threat to Siemens S7 Series PLCs
The advisory details an active cyber threat targeting Siemens S7 Series programmable logic controllers (PLCs). Malicious individuals are using AI-generated scripts disguised as monitoring tools to scan for vulnerable PLCs.
Read more → -
CISA KEV — Microsoft Internet Key Exchange (IKE) Service (CVE-2026-33824) +3 more
Four CVEs affecting Microsoft IKE, SharePoint, Broadcom VMware vCenter, and Apple macOS have been added to CISA’s KEV catalog.
Read more → -
CISA Malcolm
Versions of Malcolm prior to 26.07.0 allow unbounded archive extraction, which can exhaust filesystem resources and cause denial of service.
Read more → -
Siemens Simcenter Nastran
Simcenter Nastran and Simcenter Femap versions earlier than V2606 are vulnerable to CVE-2026-59086.
Read more → -
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2025-62593, a Ray Project vulnerability, to its KEV Catalog due to evidence of active exploitation. The advisory references Binding Operational Directive (BOD) 26-04, which requires FCEB agencies to prioritize remediation of high-risk vulnerabilities.
Read more → -
Hitachi Energy APM Edge Product
Hitachi Energy's APM Edge product versions 6.10 and earlier are affected by Dirty Frag vulnerabilities. These vulnerabilities could allow a local, unprivileged user to escalate privileges to root.
Read more → -
AVEVA Enterprise SCADA
Authenticated users with DNA Authority – Operator privilege can modify serialized data, potentially leading to code execution. The issue affects AVEVA Enterprise SCADA versions from 2021 SP2 P5 through 2025.
Read more → -
Haiwell IoT Cloud HMI Gateway
Haiwell IoT Cloud HMI Gateway version 3.40.1.12 is vulnerable to OS command injection via the /setting endpoint.
Read more → -
Siemens Simcenter Femap
Simcenter Femap versions earlier than V2606.0001 are vulnerable to out-of-bounds reads in BMP parsing.
Read more → -
Siemens Solid Edge
Solid Edge versions prior to V225.0.15 and V226.0.7 contain file-parsing bugs that may allow code execution when opening crafted PAR, PSM, or DFT files. Siemens advises updating to the latest releases to remediate the issue.
Read more → -
ANDRITZ HIPASE-250 and 250 SCALA
HIPASE-250 and 250 SCALA versions up to 7.20 store passwords in a reversible format.
Read more → -
Siemens LOGO! Soft Comfort
LOGO! Soft Comfort versions earlier than 9 use a hard-coded AES master key and unsalted password hashes.
Read more → -
Flow Neuroscience FL-100
The Flow Neuroscience FL-100 devices contain a hard-coded credential that bypasses authentication over Bluetooth. Firmware updates are available through the Flow app to remediate the issue.
Read more → -
Siemens Siveillance Video
Siemens Siveillance Video Management Servers are affected by an OS Command Injection vulnerability. The advisory states that this could allow a Remote Code Execution attack.
Read more → -
Johnson Controls Metasys
Metasys versions 12-15 are vulnerable to a persistent cross-site scripting flaw (CVE-2026-34491). The flaw allows a low-privilege user to inject a payload that runs in other users' sessions.
Read more → -
Johnson Controls Inc. Airwall
Airwall versions up to 4.0.4 contain a hard-coded cryptographic key that can decrypt stored configuration data.
Read more → -
Siemens Desigo DXR and PXC Controllers
Malformed BACnet packets can trigger a denial-of-service condition on Siemens Desigo DXR and PXC controllers.
Read more → -
Siemens License Server (SLS)
Versions of Siemens License Server earlier than 5.1 and 5.3 are vulnerable to privilege escalation and path-traversal flaws.
Read more → -
Siemens Parasolid
Parasolid versions earlier than V38.0.235 and V38.1.230 are vulnerable to an out-of-bounds read in X_T file parsing.
Read more → -
Siemens RUGGEDCOM APE1808
Siemens RUGGEDCOM APE1808 devices that include a Fortinet NGFW are listed as affected by cross-site scripting (CVE-2026-23573) and path-traversal (CVE-2026-59839) vulnerabilities.
Read more → -
CISA KEV — Cisco Secure Firewall Adaptive Security Appliance (CVE-2026-20349) +2 more
CISA added CVE-2026-20349 (Cisco ASA/FTD Heap Inspection Vulnerability), CVE-2026-68820 (Microsoft WinSock Use-After-Free Vulnerability), and CVE-2026-72898 (Metabase SQL Injection Vulnerability) to its KEV Catalog.
Read more → -
Pulsetto Vagus Nerve Stimulator
All versions of the Pulsetto Vagus Nerve Stimulator are affected by CVE-2026-18844.
Read more → -
Mira Hormone Monitor, Mira Android App
Mira Hormone Monitor firmware 1.7.1.47 and Mira Android App 4.5.15.4 are vulnerable to eight CVEs, including remote BLE authentication bypass.
Read more → -
#StopRansomware: Gunra Ransomware
Gunra ransomware uses a double-extortion model, encrypting data and threatening to publish exfiltrated files. It is offered as ransomware-as-a-service targeting government and critical-infrastructure organizations.
Read more → -
CPDLC over ATN-B1 Vulnerabilities
All ATN-B1 CPDLC versions are listed as affected. The vulnerabilities enable unauthenticated message injection and denial-of-service conditions.
Read more → -
CISA KEV — Progress LoadMaster (CVE-2026-8037)
CISA added CVE-2026-8037, a command-injection flaw in Progress LoadMaster, to its KEV catalog.
Read more → -
ABB Ability Zenon
ABB Ability Zenon IIoT services with MongoDB 4.2 are listed as affected. The advisory cites CVE-2025-14847, a mismatch in Zlib compressed protocol headers that could allow an unauthenticated client to read uninitialized heap memory.
Read more → -
Johnson Controls Inc. TL280
TL280 firmware versions earlier than 5.63 contain hard-coded credentials. Exploitation could allow access to sensitive information on the device.
Read more → -
Medixant RadiAnt DICOM
RadiAnt DICOM versions up to 2025.2 are vulnerable to a heap out-of-bounds write triggered by crafted DICOM files.
Read more → -
CISA KEV — JetBrains TeamCity (CVE-2026-63077)
CVE-2026-63077 affecting JetBrains TeamCity has been added to CISA’s KEV catalog due to active exploitation.
Read more → -
CISA KEV — IBM Langflow (CVE-2026-9198) +2 more
CISA added three new KEV entries: IBM Langflow code injection (CVE-2026-9198), N-able N-central authentication bypass (CVE-2026-18556), and Apache Tomcat missing encryption (CVE-2026-34486). These are flagged for rapid remediation on publicly exposed assets.
Read more → -
Acrisure KARR BT and DR-100
Devices with firmware older than July 20 2026 use a shared hard-coded Bluetooth key, enabling nearby attackers to issue unauthorized vehicle commands.
Read more → -
Thermo Fisher Applied Biosystems Genetic Analyzers
Thermo Fisher Applied Biosystems data collection software versions up to 4.0.2, 5.0.2, 1.2.5, 1.2.0, and 1.7.3 are listed as vulnerable. The flaw permits modification of .fsa/.hid output files, potentially altering DNA test results.
Read more → -
CISA KEV — N-able N-central (CVE-2026-18577)
CISA added CVE-2026-18577 for N-able N-central to the KEV catalog.
Read more → -
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
CISA is observing an increase in activity targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. These entities have modified passwords to lock out operators and disconnected PLCs by changing their IP addresses.
Read more → -
o6 Automation open62541
Affected open62541 versions include 1.3.0-1.3.17, 1.4.0-1.4.16, 1.5.0-1.5.4, and the master branch. The library runs on Windows and Linux.
Read more → -
Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module
The advisory reports that certain Rockwell Automation communication modules can be tricked into accepting revoked certificates, which may enable denial-of-service.
Read more → -
MZ Automation lib60870
MZ Automation lib60870 version 2.4.0 is vulnerable to out-of-bounds reads that may cause a device crash.
Read more → -
MZ Automation GmbH libiec61850
Versions of libiec61850 earlier than 1.6.2 are vulnerable to out-of-bounds reads that can cause a denial-of-service.
Read more → -
Johnson Controls OpenBlue Employee
OpenBlue Employee (FMS Employee) versions up to V2025.3.1 permit unrestricted file uploads and stored cross-site scripting.
Read more → -
Watchfire Controller Software
Watchfire Controller Software versions BC550 12.30, BC750 11.33/12.35, BC760 12.38/13.00, and BC760DC 12.39 are listed as affected by CVE-2026-5846. The vulnerability is caused by hard-coded RSA private keys embedded in the firmware.
Read more → -
Toptech Systems RCU II+ and Multiload II+
RCU II+ and Multiload II+ units released before 2025-11-24 expose an unauthenticated debug interface.
Read more → -
MikroTik RouterOS
All MikroTik RouterOS versions with the API enabled are affected by CVE-2026-14227.
Read more → -
Schneider Electric IGSS
The IGSS Definition module (Def.exe) versions up to 18.0.0.26124 are vulnerable to an out-of-bounds write via a crafted CGF file. Schneider Electric provides a fix in version 18.0.0.26125.
Read more → -
Mitsubishi Electric CC-Link IE TSN Communication Protocol
All listed Mitsubishi Electric CC-Link IE TSN controllers, modules, and interface boards are affected regardless of firmware version. Exploitation requires an attacker on the same network segment to send precisely timed packets.
Read more → -
NASA Core Flight System (cFS) Health & Safety (HS) Application
Versions up to 7.0.1 of NASA’s Core Flight System (cFS) Health & Safety (HS) application are vulnerable to a NULL pointer dereference that can cause a denial-of-service.
Read more → -
Open Source Software: Security Principles and Practices
CISA released guidance on securely using, evaluating, and publishing open source software. The guidance covers OSS risk management and vulnerability management.
Read more → -
CISA KEV — Cisco Secure Firewall Management Center (CVE-2026-20316)
CISA added CVE-2026-20316 for Cisco Secure Firewall Management Center to the KEV catalog due to active exploitation.
Read more → -
2026 Minimum Elements for a Software Bill of Materials (SBOM)
The guidance updates the NTIA 2021 minimum elements for SBOMs and incorporates 2025 stakeholder feedback.
Read more → -
igloohome Smart Lock Mobile Application
Version 3.2.3 and earlier of the igloohome Smart Lock Mobile Application for Android contain source code that includes sensitive information, potentially allowing unauthorized access to backend services.
Read more → -
ABB KNX Update Tool
ABB KNX Update Tool versions ≤ 2.0.175 lack firmware integrity checks and can be rendered unusable via physical bus access.
Read more → -
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
The advisory lists dozens of CVEs affecting the GNU/Linux subsystem of firmware V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP.
Read more → -
Siemens Desigo CC
Siemens Desigo CC V7, V8, and V9 versions prior to 9.0.1 are vulnerable to CVE-2025-15467.
Read more → -
Siemens SIMATIC S7-PLCSIM Advanced
The vulnerability allows an unauthenticated attacker on the local network to cause a denial-of-service condition via high-volume multicast traffic. Siemens is preparing fix versions and recommends mitigation steps.
Read more → -
MikroTik RouterOS and Cloud Hosted Router
All MikroTik RouterOS and Cloud Hosted Router versions are affected by CVE-2026-16347, which permits rapid password guessing due to missing rate-limiting.
Read more → -
Siemens Mendix Runtime
Developers may unintentionally grant the anonymous role access to all System.User records. This can expose sensitive user data or enable privilege escalation.
Read more → -
CI Fortify – Advice for isolating vital systems
The guidance advises critical infrastructure organizations to isolate vital operational technology and enabling systems from all other networks during disruptions.
Read more → -
CISA KEV — Fortinet FortiOS (CVE-2025-68686) +1 more
Fortinet FortiOS and Arista VeloCloud Orchestrator on-prem have been added to CISA’s KEV catalog due to active exploitation. The advisory advises rapid remediation for publicly exposed assets.
Read more → -
Panduit IntraVUE
IntraVUE versions up to 3.2.1a14 store passwords in cleartext via the API. The same versions also allow an attacker to act as an active proxy, bypassing OT segmentation.
Read more → -
Johnson Controls C-CURE 9000 and Victor application server
Versions of C-CURE 9000 and Victor up to v2.90_v3.0 (and Victor Web up to v7.1) are vulnerable to unauthenticated remote code execution. The flaw can be triggered from an adjacent network and affect physical-security workstations.
Read more → -
MZ Automation lib60870
Versions of MZ Automation lib60870 up to 2.4.0 are vulnerable to an out-of-bounds read that can cause a denial-of-service. The vendor recommends updating to 2.4.1 or later.
Read more → -
MZ Automation libIEC61850
libIEC61850 versions 1.0.0 through 1.6.1 are affected by stack- and heap-based buffer overflows. The advisory advises updating to the latest build.
Read more →
Page 2 of 5 · 440 advisories