Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
ZDI-26-544: Microsoft Windows Deployment Services Use-After-Free Remote Code Execution Vulnerability
A use-after-free in Windows Deployment Services can be triggered without authentication by a network-adjacent attacker.
Read more → -
ZDI-26-545: Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability
Remote code execution is possible on Flowise installations, but exploitation requires authentication.
Read more → -
ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability
Unauthenticated remote code execution via code injection in Flowise Airtable_Agent.
Read more → -
ZDI-26-547: OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious OPJU file or visit a crafted web page.
Read more → -
ZDI-26-548: OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
OriginLab OriginPro can be compromised via a crafted OPJ file that triggers an out-of-bounds write.
Read more → -
ZDI-26-549: OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
OriginPro's OGG file parser contains an out-of-bounds write that can be triggered by a crafted OGG file.
Read more → -
ZDI-26-550: OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability
OriginPro's OGW file parser can be triggered remotely via a crafted file, causing memory corruption.
Read more → -
ZDI-26-551: OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability
OriginLab OriginPro can be remotely compromised via a crafted OGG file, but exploitation requires the victim to open the file or visit a malicious page.
Read more → -
ZDI-26-552: OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
A crafted OPJ file can trigger an out-of-bounds write in Origin Viewer, enabling remote code execution.
Read more → -
ZDI-26-553: OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability
Origin Viewer can execute arbitrary code when parsing a malicious OGW file opened by a user. Exploitation requires the victim to visit a malicious page or open a crafted file.
Read more → -
ZDI-26-554: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
Local privilege escalation in Parallels RAS Client requires prior low-privileged code execution.
Read more → -
ZDI-26-555: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
The Parallels RAS Client RDP Backend Service has a vulnerability allowing local attackers to escalate privileges. The ZDI has assigned the CVE-2026-18262.
Read more → -
ZDI-26-556: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
The advisory notes a local privilege escalation in the Parallels RAS Client RDP backend service.
Read more → -
ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires a prior low-privileged foothold on a Wazuh worker node. The flaw is a deserialization of untrusted data in the Cluster DAPI protocol.
Read more → -
ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
Exploitation requires prior low-privileged code execution on a Wazuh worker node. The flaw is a deserialization of untrusted data in the Cluster DAPI protocol.
Read more → -
ZDI-26-529: Samsung Galaxy S25 TIFF File Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Heap-based buffer overflow in TIFF file processing on Samsung Galaxy S25 enables remote code execution.
Read more → -
ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability
The vulnerability is a local SNMP command injection that enables privilege escalation.
Read more → -
ZDI-26-531: SonicWall GMS Virtual Appliance interface Command Injection Local Privilege Escalation Vulnerability
The vulnerability enables local privilege escalation on SonicWall GMS Virtual Appliance.
Read more → -
ZDI-26-532: SonicWall Email Security updateNetIf Command Injection Local Privilege Escalation Vulnerability
Local command injection in the updateNetIf function can be leveraged for privilege escalation on SonicWall Email Security.
Read more → -
ZDI-26-533: Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability
Authentication can be bypassed without credentials on Cisco Secure Firewall Management Center login.cgi.
Read more → -
ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability
Remote attackers can bypass authentication on Microsoft Exchange without credentials.
Read more → -
ZDI-26-535: (Pwn2Own) Microsoft Exchange External Control of File Path Remote Code Execution Vulnerability
Authentication can be bypassed to achieve remote code execution on Microsoft Exchange.
Read more → -
ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability
An integer overflow in the Windows http.sys driver enables local privilege escalation.
Read more → -
ZDI-26-537: (Pwn2Own) Microsoft Windows storport Integer Overflow Local Privilege Escalation Vulnerability
The advisory reports an integer overflow in the Windows storport driver that enables local privilege escalation.
Read more → -
ZDI-26-538: (Pwn2Own) Microsoft Exchange Improper Authorization Privilege Escalation Vulnerability
Remote attackers can bypass authentication to gain higher privileges on Microsoft Exchange.
Read more → -
ZDI-26-539: (Pwn2Own) Microsoft Windows ipt.sys Incorrect Permission Assignment Local Privilege Escalation Vulnerability
The advisory notes that ipt.sys has incorrect permission assignment enabling local privilege escalation.
Read more → -
ZDI-26-540: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Information Disclosure Vulnerability
The win32kfull subsystem contains a use-after-free that can disclose sensitive data after low-privilege code execution.
Read more → -
ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability
The advisory reports a use-after-free flaw in win32kfull that enables local privilege escalation.
Read more → -
#StopRansomware: Gunra Ransomware
Gunra ransomware uses a double-extortion model, encrypting data and threatening to publish exfiltrated files. It is offered as ransomware-as-a-service targeting government and critical-infrastructure organizations.
Read more → -
CPDLC over ATN-B1 Vulnerabilities
All ATN-B1 CPDLC versions are listed as affected. The vulnerabilities enable unauthenticated message injection and denial-of-service conditions.
Read more → -
CISA KEV — Progress LoadMaster (CVE-2026-8037)
CISA added CVE-2026-8037, a command-injection flaw in Progress LoadMaster, to its KEV catalog.
Read more → -
ABB Ability Zenon
ABB Ability Zenon IIoT services with MongoDB 4.2 are listed as affected. The advisory cites CVE-2025-14847, a mismatch in Zlib compressed protocol headers that could allow an unauthenticated client to read uninitialized heap memory.
Read more → -
Johnson Controls Inc. TL280
TL280 firmware versions earlier than 5.63 contain hard-coded credentials. Exploitation could allow access to sensitive information on the device.
Read more → -
Medixant RadiAnt DICOM
RadiAnt DICOM versions up to 2025.2 are vulnerable to a heap out-of-bounds write triggered by crafted DICOM files.
Read more → -
CISA KEV — JetBrains TeamCity (CVE-2026-63077)
CVE-2026-63077 affecting JetBrains TeamCity has been added to CISA’s KEV catalog due to active exploitation.
Read more → -
ZDI-26-524: (0Day) PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
The Q80 XCB daemon accepts unauthenticated requests that can read and alter configuration data.
Read more → -
ZDI-26-525: (0Day) PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability
Unauthenticated attackers can achieve remote code execution on PAX Technology Q80 via crafted AIP files.
Read more → -
ZDI-26-526: (0Day) PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability
Unauthenticated attackers can bypass the Q80 Application Installer’s signature verification to execute code remotely.
Read more → -
CISA KEV — IBM Langflow (CVE-2026-9198) +2 more
CISA added three new KEV entries: IBM Langflow code injection (CVE-2026-9198), N-able N-central authentication bypass (CVE-2026-18556), and Apache Tomcat missing encryption (CVE-2026-34486). These are flagged for rapid remediation on publicly exposed assets.
Read more → -
Acrisure KARR BT and DR-100
Devices with firmware older than July 20 2026 use a shared hard-coded Bluetooth key, enabling nearby attackers to issue unauthorized vehicle commands.
Read more → -
Thermo Fisher Applied Biosystems Genetic Analyzers
Thermo Fisher Applied Biosystems data collection software versions up to 4.0.2, 5.0.2, 1.2.5, 1.2.0, and 1.7.3 are listed as vulnerable. The flaw permits modification of .fsa/.hid output files, potentially altering DNA test results.
Read more → -
CISA KEV — N-able N-central (CVE-2026-18577)
CISA added CVE-2026-18577 for N-able N-central to the KEV catalog.
Read more → -
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
CISA is observing an increase in activity targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. These entities have modified passwords to lock out operators and disconnected PLCs by changing their IP addresses.
Read more → -
o6 Automation open62541
Affected open62541 versions include 1.3.0-1.3.17, 1.4.0-1.4.16, 1.5.0-1.5.4, and the master branch. The library runs on Windows and Linux.
Read more → -
Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module
The advisory reports that certain Rockwell Automation communication modules can be tricked into accepting revoked certificates, which may enable denial-of-service.
Read more → -
MZ Automation lib60870
MZ Automation lib60870 version 2.4.0 is vulnerable to out-of-bounds reads that may cause a device crash.
Read more → -
MZ Automation GmbH libiec61850
Versions of libiec61850 earlier than 1.6.2 are vulnerable to out-of-bounds reads that can cause a denial-of-service.
Read more → -
Johnson Controls OpenBlue Employee
OpenBlue Employee (FMS Employee) versions up to V2025.3.1 permit unrestricted file uploads and stored cross-site scripting.
Read more → -
Watchfire Controller Software
Watchfire Controller Software versions BC550 12.30, BC750 11.33/12.35, BC760 12.38/13.00, and BC760DC 12.39 are listed as affected by CVE-2026-5846. The vulnerability is caused by hard-coded RSA private keys embedded in the firmware.
Read more → -
Toptech Systems RCU II+ and Multiload II+
RCU II+ and Multiload II+ units released before 2025-11-24 expose an unauthenticated debug interface.
Read more → -
MikroTik RouterOS
All MikroTik RouterOS versions with the API enabled are affected by CVE-2026-14227.
Read more → -
Schneider Electric IGSS
The IGSS Definition module (Def.exe) versions up to 18.0.0.26124 are vulnerable to an out-of-bounds write via a crafted CGF file. Schneider Electric provides a fix in version 18.0.0.26125.
Read more → -
Mitsubishi Electric CC-Link IE TSN Communication Protocol
All listed Mitsubishi Electric CC-Link IE TSN controllers, modules, and interface boards are affected regardless of firmware version. Exploitation requires an attacker on the same network segment to send precisely timed packets.
Read more → -
NASA Core Flight System (cFS) Health & Safety (HS) Application
Versions up to 7.0.1 of NASA’s Core Flight System (cFS) Health & Safety (HS) application are vulnerable to a NULL pointer dereference that can cause a denial-of-service.
Read more → -
Open Source Software: Security Principles and Practices
CISA released guidance on securely using, evaluating, and publishing open source software. The guidance covers OSS risk management and vulnerability management.
Read more → -
ZDI-26-502: (Pwn2Own) Phoenix Contact CHARX SEC-3150 user-applications Link Following Local Privilege Escalation Vulnerability
The advisory notes a local privilege escalation on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-503: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Race Condition Firewall Bypass Vulnerability
Unauthenticated network-adjacent attackers can bypass firewall rules on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-504: (Pwn2Own) Phoenix Contact CHARX SEC-3150 CharxSystemConfigManager Configuration Injection Remote Code Execution Vulnerability
Unauthenticated remote code execution is possible on Phoenix Contact CHARX SEC-3150 devices via configuration injection.
Read more → -
ZDI-26-505: (Pwn2Own) Phoenix Contact CHARX SEC-3150 charx-system-config-manager Service CRLF Injection Firewall Bypass Vulnerability
Unauthenticated network-adjacent attackers can bypass firewall rules on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-506: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Insertion of Sensitive Information into Log File Authentication Bypass Vulnerability
Authentication can be bypassed without credentials on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-507: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Privilege Defined With Unsafe Actions Local Privilege Escalation Vulnerability
Local privilege escalation on Phoenix Contact CHARX SEC-3150 requires prior low-privileged code execution.
Read more → -
ZDI-26-508: (Pwn2Own) Phoenix Contact CHARX SEC-3150 charx_set_ip_address Improper Input Validation Local Privilege Escalation Vulnerability
Improper input validation in charx_set_ip_address enables local privilege escalation on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-509: (Pwn2Own) Phoenix Contact CHARX SEC-3150 OCPP Missing Authentication for Critical Function Authentication Bypass Vulnerability
Unauthenticated network-adjacent attackers can modify configuration on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-510: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Missing Cryptographic Signature Remote Code Execution Vulnerability
Network-adjacent attackers can bypass firmware validation on Phoenix Contact CHARX SEC-3150 devices without authentication.
Read more → -
ZDI-26-511: (Pwn2Own) Phoenix Contact CHARX SEC-3150 user-applications Symlink Following Local Privilege Escalation Vulnerability
The advisory notes a local privilege escalation via symlink following on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-512: (Pwn2Own) Phoenix Contact CHARX SEC-3150 ModBus Server Exposed Dangerous Function Denial-of-Service Vulnerability
Unauthenticated network-adjacent attackers can cause a denial-of-service on the Phoenix Contact CHARX SEC-3150 ModBus server.
Read more → -
ZDI-26-513: (Pwn2Own) Phoenix Contact CHARX SEC-3150 update2-upload Arbitrary File Upload Vulnerability
Authenticated, network-adjacent attackers can upload arbitrary files to Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-514: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Failing Open Authentication Bypass Vulnerability
Authentication can be bypassed without credentials on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-515: (Pwn2Own) Phoenix Contact CHARX SEC-3150 charx-jupicore Missing Authentication Configuration Modification Vulnerability
Unauthenticated configuration modification is possible on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-516: (Pwn2Own) Phoenix Contact CHARX SEC-3150 ModBus Server Exposed Dangerous Function Denial-of-Service Vulnerability
Unauthenticated attackers can trigger a denial-of-service on Phoenix Contact CHARX SEC-3150 ModBus servers.
Read more → -
ZDI-26-517: (Pwn2Own) Phoenix Contact CHARX SEC-3150 BackendURL WebSocket Command Injection Remote Code Execution Vulnerability
The advisory notes that authentication can be bypassed, enabling remote code execution via a WebSocket BackendURL command injection.
Read more → -
ZDI-26-518: (Pwn2Own) Phoenix Contact CHARX SEC-3150 MQTT Service Server-Side Request Forgery Remote Code Execution Vulnerability
Unauthenticated network-adjacent attackers can exploit an SSRF flaw in the MQTT service of Phoenix Contact CHARX SEC-3150 devices. The issue is identified as CVE-2026-44091 with a CVSS score of 6.3.
Read more → -
ZDI-26-519: (Pwn2Own) Phoenix Contact CHARX SEC-3150 CharxSystemConfigManager Configuration Injection Remote Code Execution Vulnerability
Unauthenticated remote code execution is possible on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-520: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Jupicore External Control of Path Remote Code Execution Vulnerability
Unauthenticated remote code execution is possible on Phoenix Contact CHARX SEC-3150 devices.
Read more → -
ZDI-26-521: Phoenix Contact CHARX SEC-3000 Command Injection Remote Code Execution Vulnerability
Authentication is required to exploit the command injection on CHARX SEC-3000 devices.
Read more → -
ZDI-26-522: Phoenix Contact CHARX SEC-3000 Insertion of Sensitive Information into Log File Information Disclosure Vulnerability
Unauthenticated network-adjacent attackers can retrieve sensitive data from the CHARX SEC-3000 log file.
Read more → -
ZDI-26-523: Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
Deserialization of untrusted checkpoint files can lead to remote code execution.
Read more → -
CISA KEV — Cisco Secure Firewall Management Center (CVE-2026-20316)
CISA added CVE-2026-20316 for Cisco Secure Firewall Management Center to the KEV catalog due to active exploitation.
Read more → -
2026 Minimum Elements for a Software Bill of Materials (SBOM)
The guidance updates the NTIA 2021 minimum elements for SBOMs and incorporates 2025 stakeholder feedback.
Read more → -
ZDI-26-487: (Pwn2Own) Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability
The udhcpd daemon on Kenwood DNR1007XR devices has an incorrect permission assignment that enables local privilege escalation.
Read more → -
ZDI-26-488: (Pwn2Own) Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability
The vulnerability is a heap-based buffer overflow in the vCardParser of Kenwood DNR1007XR.
Read more → -
ZDI-26-489: (Pwn2Own) Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability
Unauthenticated command injection in startUpdateProcess enables arbitrary code execution on Kenwood DNR1007XR devices.
Read more → -
ZDI-26-490: (Pwn2Own) Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability
The advisory notes that the vulnerability stems from incorrect default USB permissions on the Kenwood DNR1007XR, allowing local privilege escalation. Exploitation requires a low-privileged code execution step and physical presence.
Read more → -
ZDI-26-491: Apple macOS CoreAudio Out-Of-Bounds Write Remote Code Execution Vulnerability
Exploitation requires the victim to open a malicious file or visit a malicious webpage.
Read more → -
ZDI-26-492: Apple macOS ImageIO Numeric Truncation Remote Code Execution Vulnerability
The issue is a numeric truncation flaw in macOS’s ImageIO library.
Read more → -
ZDI-26-493: Apple macOS USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Exploitation requires interaction with the macOS USD library and triggers a heap-based buffer overflow.
Read more → -
ZDI-26-494: Apple macOS USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Exploitation requires interaction with the macOS USD library and triggers a heap-based buffer overflow.
Read more → -
ZDI-26-495: (Pwn2Own) VMware ESXi VMXNET3 espQueueMask Out-Of-Bounds Write Local Privilege Escalation Vulnerability
The advisory notes a local privilege escalation vulnerability in VMware ESXi.
Read more → -
ZDI-26-496: Trend AI Cleaner One Pro Link Following Arbitrary File Deletion Vulnerability
Local low-privileged code can delete arbitrary files via the link-following feature in Trend Micro Cleaner One Pro.
Read more → -
ZDI-26-497: TrendAI Vision One Service Gateway Logs Information Disclosure Vulnerability
Remote authenticated attackers can obtain sensitive information from TrendAI Vision One Service Gateway logs.
Read more → -
ZDI-26-498: TrendAI Vision One Incorrect Privilege Assignment Privilege Escalation Vulnerability
Remote authenticated attackers can elevate privileges on TrendAI Vision One.
Read more → -
ZDI-26-499: WatchGuard FireWare OS cli Token Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability
Authentication is required to exploit a stack-based buffer overflow in the WatchGuard FireWare OS CLI token parser.
Read more → -
ZDI-26-500: WatchGuard FireWare OS networkd network_wireless_kick_off_user_cb Stack-based Buffer Overflow Remote Code Execution Vulnerability
Exploitation requires valid authentication credentials.
Read more → -
ZDI-26-501: WatchGuard FireWare OS sigd comp_start_cb Directory Traversal Arbitrary File Creation Vulnerability
Remote authenticated attackers can create arbitrary files via the sigd comp_start_cb directory traversal in WatchGuard FireWare OS.
Read more → -
ZDI-26-453: GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability
Exploitation requires a user to open a malicious HDR file or visit a crafted webpage.
Read more → -
ZDI-26-454: GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability
Integer overflow in GIMP's PSD file parser can lead to remote code execution.
Read more → -
ZDI-26-455: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP’s TIF parser contains a heap-based buffer overflow that can be triggered by a crafted TIF file.
Read more → -
ZDI-26-456: GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
The flaw is a stack-based buffer overflow in GIMP’s TIF parser that requires the victim to open a crafted file or page.
Read more → -
ZDI-26-457: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability
GIMP’s TIF parser contains an integer overflow that can be triggered by a crafted TIF file.
Read more → -
ZDI-26-458: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability
The flaw is an integer overflow in GIMP’s TIF parser that can be triggered by a crafted file. Exploitation requires the victim to open the file or view it via a malicious page.
Read more →
Page 5 of 12 · 1,153 advisories