Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
CISA KEV — Ivanti Connect Secure (CVE-2026-111357) +1 more
Ivanti Connect Secure has two vulnerabilities now listed in CISA’s KEV Catalog.
Read more → -
CISA KEV — Ivanti Connect Secure (CVE-2026-111357) +1 more
CISA added CVE-2026-111357 for Ivanti Connect Secure and CVE-2026-97229 for GitLab CE/EE to its KEV catalog.
Read more → -
Hitachi Energy TRO600 series products
TRO600 versions up to 9.2.1.6 are vulnerable to authenticated remote code execution via localhost service bypass and to unauthenticated arbitrary file read.
Read more → -
Siemens Mendix SAML Module
Versions of the Siemens Mendix SAML module prior to 4.2.4 (Mendix 10/11) and 3.6.29 (Mendix 9) are vulnerable to authentication bypass via SAML assertion replay.
Read more → -
Hitachi Energy CoreTec Product
CoreTec5 versions ≤3.4.0 and CoreTec4 versions ≤3.4.0 are vulnerable to OS command injection (CVE-2026-13162). Hitachi Energy recommends updating to CoreTec5 version 5.0.0.
Read more → -
CISA KEV — Broadcom VMWare ESX (CVE-2026-41709) +1 more
CISA added CVE-2026-41709 (Broadcom VMWare ESX) and CVE-2026-46300 (Linux kernel) to the KEV catalog. Both are reported as actively exploited.
Read more → -
CISA KEV — Adobe Commerce and Magento (CVE-2026-48356) +1 more
Adobe Commerce/Magento and Google Brotli have been added to CISA’s KEV catalog due to active exploitation.
Read more → -
EPICS Base
EPICS Base releases up to version 7.0.10 are affected by multiple critical vulnerabilities. The advisory provides a fix in version 7.0.11.
Read more → -
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Multiple Mitsubishi Electric industrial software products, including GENESIS64 and ICONICS Suite, are vulnerable in versions up to 10.97.3. The listed CVEs could enable code execution, authentication bypass, or denial-of-service.
Read more → -
CISA KEV — PHP Memory Corruption (CVE-2026-109618) +1 more
CISA added two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalog.
Read more → -
CISA KEV — Collabora Online – Built-in CODE Server (CVE-2026-110447)
CVE-2026-110447 in Collabora Online’s built-in CODE Server is now listed in CISA’s KEV catalog.
Read more → -
CISA KEV — Arista VeloCloud Orchestrator (CVE-2026-114625)
Arista VeloCloud Orchestrator has a SQL injection vulnerability (CVE-2026-114625) now listed in CISA’s KEV catalog.
Read more → -
Kiloview E3 NDI Encoder
Kiloview E3 firmware versions earlier than 1.30 are vulnerable. Exploitation could give an attacker full control of the device.
Read more → -
Siemens SIMATIC S7-1500 TM MFP
All versions of the SIMATIC S7-1500 TM MFP GNU/Linux subsystem are listed as vulnerable, with 377 CVSS-10 findings.
Read more → -
Siemens SENTRON 3NA COM Fuse
The advisory reports a denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse firmware versions earlier than 5.2.
Read more → -
Siemens SIMATIC S7 PLCs Web Server
All listed SIMATIC S7-1500 PLC models are affected by eight web-server vulnerabilities (CVE-2026-63350 through CVE-2026-63357).
Read more → -
Siemens Industrial Edge Devices
Multiple Siemens Industrial Edge devices have path-traversal flaws that allow an authenticated attacker to read internal files. Siemens has released updated firmware for several models.
Read more → -
Siemens SIMATIC IPCs
Siemens SIMATIC IPC models are vulnerable to a test key that can bypass UEFI Secure Boot.
Read more → -
Siemens RUGGEDCOM CROSSBOW Station Access Controller
SAC firmware versions earlier than 6.0 embed vulnerable SQLite code that may permit code execution or data leakage.
Read more → -
Siemens Software Center
Versions of Siemens Software Center earlier than 4.0.9.8 load DLLs from an uncontrolled search path.
Read more → -
Siemens PSS(R)SINCAL
The WibuKey driver used by Siemens PSS(R)SINCAL can cause an out-of-bounds write leading to a system crash when the legacy dongle license is configured.
Read more → -
InterSystems Corporation InterSystems IRIS for Health
InterSystems IRIS for Health versions 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221 ship with TLS/SSL disabled by default, exposing cleartext traffic. The advisory states an attacker could view transmitted data and use it to log into the device.
Read more → -
Siemens Capital Embedded AR Classic
An out-of-bounds read (CVE-2026-89208) affects Siemens Capital Embedded AR Classic 431-422 (all versions) and R20-11 versions earlier than V2303.
Read more → -
Siemens Industrial Edge Device Kit
Multiple arm64 versions of Siemens Industrial Edge Device Kit (V1.10-V1.25) contain path-traversal vulnerabilities (CVE-2026-44414, CVE-2026-44415). The flaws require authentication and could expose internal data.
Read more → -
Siemens WinCC
The advisory notes that WinCC versions prior to 8.0.0.11 and 8.1.7 are vulnerable to database privilege escalation.
Read more → -
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
The advisory notes 428 vulnerabilities in the GNU/Linux subsystem of firmware version ≥ 3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP.
Read more → -
Siemens Industrial Edge App Publisher
Versions of Siemens Industrial Edge App Publisher prior to 1.27.9 are vulnerable to certificate validation bypass and XSS that can enable remote code execution.
Read more → -
Siemens RUGGEDCOM APE1808 Devices
All Siemens RUGGEDCOM APE1808 devices are listed as affected by multiple CVEs.
Read more → -
Siemens RUGGEDCOM CROSSBOW
Versions of Siemens RUGGEDCOM CROSSBOW earlier than 6.0 are affected by multiple high-severity vulnerabilities. Siemens advises updating to version 6.0 or later.
Read more → -
Siemens APOGEE, TALON and Desigo PXC/PXM Products
All versions of Siemens APOGEE MBC and MEC devices are listed as vulnerable to four CVEs that may cause denial-of-service. Siemens advises updating to the latest firmware where fixes exist.
Read more → -
Siemens SIMATIC S7 Webserver API
Versions of the .NET Client Library for SIMATIC S7 Webserver API prior to 3.3.61 are vulnerable to path-traversal and information-leak flaws. Siemens advises updating to version 3.3.61 or newer.
Read more → -
Managing AI Token Consumption for Operational Resilience
Unmanaged AI token consumption can cause cost spikes, performance degradation, and denial-of-tokens attacks.
Read more → -
Critical Vulnerabilities in PHP Require Immediate Patching
CISA reports two PHP remote code execution flaws (CVE-2026-109618, CVE-2026-109619) that affect all PHP installations serving web traffic. The advisory recommends updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Read more → -
CISA KEV — Plex Media Server (CVE-2026-96652) +5 more
Four of the six newly cataloged KEV entries affect Plex Media Server.
Read more → -
#StopRansomware: SafePay Ransomware
The advisory lists five CVEs that can be exploited by the SafePay ransomware group. The group has been active since August 2024 targeting organizations in multiple regions.
Read more → -
Hitachi Energy MicroSCADA X SYS600 Product
CSV injection in MicroSCADA X SYS600 can allow malicious formulas in exported logs; Hitachi Energy recommends updating to version 10.8.
Read more → -
Moxa AIG-302 ThingsPro Edge
Firmware versions 1.4.0 and earlier are affected; Moxa provides a fix in version 1.4.1.
Read more → -
Hitachi Energy RTU500 Product
Hitachi Energy RTU500 series CMU firmware versions 12.7.1–12.7.7 and 13.5.1–13.8.2 are listed as vulnerable. The advisory assigns a CVSS v3 score of 8.8.
Read more → -
WAGO OS Linux
Authenticated low-privileged users can bypass privilege boundaries in the WBM interface of WAGO OS Linux. The issue affects firmware versions 1.0.0 up to but not including 4.10.0 on multiple WAGO controller models.
Read more → -
HMS Networks PEAK-System PCAN Windows drivers
PEAK-System PCAN Windows drivers version 5.1.2 (or 5.1.2.1151) are vulnerable to kernel-crashing bugs. The advisory recommends upgrading to version 5.1.4.
Read more → -
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
BeyondTrust Remote Support versions 26.2.3 and earlier are vulnerable to CVE-2026-102764.
Read more → -
CISA KEV — Fortinet Multiple Products (CVE-2025-61624) +1 more
Fortinet multiple products and BeyondTrust Remote Support have been added to CISA’s KEV catalog, indicating active exploitation.
Read more → -
Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation
The advisory provides ten voluntary core practices for organizations that train and evaluate highly capable super-intelligence agents.
Read more → -
Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
Phishing and smishing are identified as primary techniques targeting election officials.
Read more → -
CISA KEV — Atlassian Multiple Products (CVE-2026-21589)
CVE-2026-21589 impacts multiple Atlassian products by exposing files or directories to external parties.
Read more → -
CISA Malcolm
Malcolm versions up to v26.07.1 permit unauthenticated access to the Arkime backend via a crafted URL path.
Read more → -
Eclipse Foundation Eclipse Milo
Eclipse Milo versions 0.6.0 through 1.1.4 are affected by multiple high-severity vulnerabilities.
Read more → -
Guangzhou Juan IoT Technology EseeCloud
EseeCloud App versions up to 4.9.6 and firmware up to 4.9.86.0 contain hard-coded credentials.
Read more → -
J4Care dcm4che
Version 5.35.1 of J4Care dcm4chee-arc-light is affected; a fix is provided in release 5.35.2.
Read more → -
Thermo Fisher Torrent Suite Software
Thermo Fisher Torrent Suite Software versions up to 5.18 are vulnerable to a path-traversal flaw that allows an authenticated attacker to read arbitrary files.
Read more → -
CISA KEV — Palo Alto Networks PAN-OS (CVE-2026-0322) +3 more
Four CVEs—CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134—have been added to CISA’s KEV Catalog. They are flagged due to observed active exploitation.
Read more → -
Inductive Automation Ignition Software
The Ignition Perspective module can let an authenticated low-level user obtain Designer-level privileges.
Read more → -
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.
Read more → -
CISA KEV — Microsoft Windows (CVE-2026-96951) +1 more
CVE-2026-96951 is a command-injection flaw in Microsoft Windows. CVE-2026-104935 is an authentication-bypass flaw in Ivanti Connect Secure.
Read more → -
Swann Communications SWIFI-SE2KIC
SWIFI-SE2KIC cameras with firmware ≤ 2.0.22 permit unauthenticated viewing of live video on the local network.
Read more → -
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Actors are targeting Microsoft Exchange servers using multiple CVEs, including CVE-2021-22205.
Read more → -
Grid Protection Alliance openPDC and openHistorian
openPDC versions earlier than 2.9.482 and openHistorian versions earlier than 2.8.585 are listed as vulnerable. The advisory notes remote code execution is possible via deserialization of untrusted data.
Read more → -
Satel Netco Design
Satel Netco Design versions prior to v2.1.7 are vulnerable to stored cross-site scripting and a regex-based denial-of-service.
Read more → -
Red Lion Controls N-Tron 700 Series
The N-Tron 700 Series firmware ≤ 3.11.0 contains hard-coded credentials that allow administrative access.
Read more → -
Hitachi Energy RTU500
RTU500 series CMU firmware versions 11.x and earlier are identified as vulnerable. These versions are end-of-life and no longer receive security updates.
Read more → -
Savannah lwIP SMTP client
The advisory reports a buffer overflow in Savannah lwIP SMTP client 2.2.1. A patch (patch_125_smtp_txbuf.diff) has been released.
Read more → -
Hitachi Energy SOI
SOI versions 2.0.0-2.2.0 contain an ActiveMQ code-injection flaw (CVE-2026-34197).
Read more → -
Johnson Controls EasyIO FG
EasyIO FG firmware up to version 2.0b52 contains hard-coded credentials and lacks a patch because the product is end-of-life. No firmware update will be released.
Read more → -
Hitachi Energy Asset Suite
Asset Suite versions 9.9.0 and earlier allow unauthenticated access to the HTTPPublishAdapterTestServlet. Upgrade to 9.9.1 or disable the servlet to mitigate.
Read more → -
Hitachi Energy REB500
REB500 versions 8.3.3.1 and earlier are vulnerable to denial-of-service via libexpat flaws.
Read more → -
CISA KEV — Citrix NetScaler (CVE-2026-88779)
CVE-2026-88779 targets Citrix NetScaler appliances and is listed as a known exploited vulnerability.
Read more → -
CISA KEV — Zammad GmbH Zammad Session Fixation (CVE-2026-102489) +1 more
CISA added CVE-2026-102489 and CVE-2026-102490 for Zammad to the KEV Catalog, indicating active exploitation.
Read more → -
CISA KEV — Fortinet FortiMail (CVE-2026-104286)
FortiMail path traversal vulnerability (CVE-2026-104286) has been added to CISA’s KEV catalog.
Read more → -
CISA Malcolm
Versions of CISA Malcolm earlier than 26.06.0 are listed as affected. The advisory reports that unauthenticated attackers can craft links that execute arbitrary script.
Read more → -
Johnson Controls EasyIO Neo Series EC and CW Controllers
Versions V3.3b62, V3.3b63, V3.3b24, and V3.3b25 transmit credentials and session data in cleartext.
Read more → -
ABB Protection and Control IED Manager PCM600
PCM600 versions up to 2.14 permit local users to elevate privileges via the Scheduler Service.
Read more → -
Meari IoT Cloud Platform OpenAPI Service
All versions of Meari IoT Cloud Platform OpenAPI Service are affected by missing-authorization vulnerabilities.
Read more → -
Johnson Controls EasyIO Neo Series EC and CW Controllers
Firmware versions V3.3b62, V3.3b63 (EC) and V3.3b24, V3.3b25 (CW) are identified as vulnerable.
Read more → -
Monta monta.app
All versions of Monta monta.app are affected. Unauthenticated WebSocket endpoints allow attackers to impersonate charging stations.
Read more → -
Armatura LLC Armatura One
Armatura One versions prior to 4.7.2 expose an unauthenticated ActiveMQ OpenWire listener.
Read more → -
CISA Adds One Known Exploited Vulnerability to Catalog
Cisco Catalyst SD-WAN Manager is listed in CISA’s KEV catalog due to active exploitation of CVE-2026-76504.
Read more → -
CISA KEV — Apple Multiple Products (CVE-2026-86950)
CISA added CVE-2026-86950, an out-of-bounds write bug affecting multiple Apple products, to the KEV catalog. The advisory urges rapid remediation on publicly exposed assets.
Read more → -
Lantronix G520 Series Cellular Gateway
Lantronix G520 Series Cellular Gateway version 2.6.0.4R6_stable is vulnerable to remote code execution via its update mechanism.
Read more → -
Toptech TMS7 and TopHAT
Toptech TMS7 and TopHAT version 7.6.3 are vulnerable to unauthenticated database export. The vendor released version 7.8 that resolves the issues.
Read more → -
Viidure Dashcam Android Application
The advisory reports that the dashcam platform’s cloud storage bucket is publicly readable, exposing user data and firmware.
Read more → -
Anjvision YSSD-RTMP-H5
Firmware 3.3.2.4_build_2024-12-26 of the Anjvision YSSD-RTMP-H5 is listed as affected.
Read more → -
VIVOTEK Camera Firmware
Remote command execution with root privileges is possible on the listed VIVOTEK camera firmware versions.
Read more → -
MikroTik RouterOS
RouterOS versions prior to 7.24 contain an unauthenticated integer underflow in the web management service.
Read more → -
Baicells Nova 430H
Unauthenticated devices within radio range can send malformed uplink messages that may cause a denial-of-service condition on the eNodeB. The issue affects Nova 430H eNodeB firmware versions up to BaiBLQ_3.0.12.
Read more → -
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
CVE-2026-88771 and CVE-2026-88772 are critical zero-day flaws in Citrix NetScaler ADC and Gateway that enable remote code execution.
Read more → -
CISA KEV — Citrix NetScaler (CVE-2026-88771) +1 more
Two Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) have been added to CISA’s Known Exploited Vulnerabilities catalog.
Read more → -
CISA KEV — WordPress Core Remote File Inclusion (CVE-2026-87902)
WordPress core versions vulnerable to CVE-2026-87902 have been added to CISA’s KEV catalog. The vulnerability is a remote file inclusion that is actively exploited.
Read more → -
CISA KEV — Microsoft SharePoint (CVE-2026-65660) +1 more
Microsoft SharePoint and Mikrotik RouterOS have been added to the KEV catalog due to active exploitation.
Read more → -
CISA KEV — WSO2 Multiple Products (CVE-2026-5430) +1 more
CISA added CVE-2026-5430 (WSO2 path-traversal) and CVE-2026-71362 (Adobe Commerce/Magento incorrect-authorization) to its KEV Catalog.
Read more → -
Eufy Omni C20, Omni X10 Pro
Versions earlier than 1.6.4 of the Eufy Omni C20 and Omni X10 Pro are vulnerable to command injection and hard-coded credentials.
Read more → -
Botslab G980H Dashcams
Botslab G980H dashcams (firmware series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+) are identified as vulnerable. The advisory notes multiple CVEs allowing authentication bypass and device manipulation.
Read more → -
Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
The fact sheet advises applying the principle of least privilege to third-party ICS integrators.
Read more → -
CISA KEV — Check Point Multiple Products (CVE-2026-85102) +3 more
Four CVEs affecting Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM have been added to the KEV catalog. The catalog addition signals active exploitation of these flaws.
Read more → -
lwIP TCP/IP Stack MQTT Client Application
lwIP MQTT Client Application versions 2.0.1 through 2.2.1 are vulnerable to an out-of-bounds write.
Read more → -
Siemens Siveillance Control
The OIS web module in Siemens Siveillance Control permits arbitrary file upload, which can lead to root-level compromise. Siemens provides patches that update the OIS component to fixed versions.
Read more → -
Siemens SIMOVE Fleetmanager and SIPLANT
Siemens SIMOVE Fleetmanager and SIPLANT are vulnerable to a relative path-traversal flaw (CVE-2026-67367). Siemens has published newer versions and advises updating to the latest releases.
Read more → -
Siemens Desigo CC family
Siemens Desigo CC V6 and V7 can execute embedded scripts in user-defined graphics, enabling client-side code execution.
Read more → -
Siemens SIPLUS and SIMATIC Products
Multiple Siemens SIPLUS and SIMATIC products are listed as vulnerable to CVE-2026-31431. Siemens has released newer software versions and advises updating to the latest releases.
Read more → -
Siemens WTV676 and WTV776
Unauthenticated attackers can force the devices into protection mode, disabling web access. Siemens advises updating to the latest Web Interface versions.
Read more → -
lwIP (Lightweight IP)
lwIP versions 2.0.1 through 2.2.1 are affected by a double-free vulnerability (CVE-2026-91018).
Read more →
Page 1 of 5 · 480 advisories