Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
BeyondTrust Remote Support versions 26.2.3 and earlier are vulnerable to CVE-2026-102764.
Read more → -
CISA KEV — Fortinet Multiple Products (CVE-2025-61624) +1 more
Fortinet multiple products and BeyondTrust Remote Support have been added to CISA’s KEV catalog, indicating active exploitation.
Read more → -
Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation
The advisory provides ten voluntary core practices for organizations that train and evaluate highly capable super-intelligence agents.
Read more → -
Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
Phishing and smishing are identified as primary techniques targeting election officials.
Read more → -
CISA KEV — Atlassian Multiple Products (CVE-2026-21589)
CVE-2026-21589 impacts multiple Atlassian products by exposing files or directories to external parties.
Read more → -
CISA Malcolm
Malcolm versions up to v26.07.1 permit unauthenticated access to the Arkime backend via a crafted URL path.
Read more → -
Eclipse Foundation Eclipse Milo
Eclipse Milo versions 0.6.0 through 1.1.4 are affected by multiple high-severity vulnerabilities.
Read more → -
Guangzhou Juan IoT Technology EseeCloud
EseeCloud App versions up to 4.9.6 and firmware up to 4.9.86.0 contain hard-coded credentials.
Read more → -
J4Care dcm4che
Version 5.35.1 of J4Care dcm4chee-arc-light is affected; a fix is provided in release 5.35.2.
Read more → -
Thermo Fisher Torrent Suite Software
Thermo Fisher Torrent Suite Software versions up to 5.18 are vulnerable to a path-traversal flaw that allows an authenticated attacker to read arbitrary files.
Read more → -
CISA KEV — Palo Alto Networks PAN-OS (CVE-2026-0322) +3 more
Four CVEs—CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134—have been added to CISA’s KEV Catalog. They are flagged due to observed active exploitation.
Read more → -
Inductive Automation Ignition Software
The Ignition Perspective module can let an authenticated low-level user obtain Designer-level privileges.
Read more → -
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.
Read more → -
CISA KEV — Microsoft Windows (CVE-2026-96951) +1 more
CVE-2026-96951 is a command-injection flaw in Microsoft Windows. CVE-2026-104935 is an authentication-bypass flaw in Ivanti Connect Secure.
Read more → -
Swann Communications SWIFI-SE2KIC
SWIFI-SE2KIC cameras with firmware ≤ 2.0.22 permit unauthenticated viewing of live video on the local network.
Read more → -
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Actors are targeting Microsoft Exchange servers using multiple CVEs, including CVE-2021-22205.
Read more → -
Grid Protection Alliance openPDC and openHistorian
openPDC versions earlier than 2.9.482 and openHistorian versions earlier than 2.8.585 are listed as vulnerable. The advisory notes remote code execution is possible via deserialization of untrusted data.
Read more → -
Satel Netco Design
Satel Netco Design versions prior to v2.1.7 are vulnerable to stored cross-site scripting and a regex-based denial-of-service.
Read more → -
Red Lion Controls N-Tron 700 Series
The N-Tron 700 Series firmware ≤ 3.11.0 contains hard-coded credentials that allow administrative access.
Read more → -
Hitachi Energy RTU500
RTU500 series CMU firmware versions 11.x and earlier are identified as vulnerable. These versions are end-of-life and no longer receive security updates.
Read more → -
Savannah lwIP SMTP client
The advisory reports a buffer overflow in Savannah lwIP SMTP client 2.2.1. A patch (patch_125_smtp_txbuf.diff) has been released.
Read more → -
Hitachi Energy SOI
SOI versions 2.0.0-2.2.0 contain an ActiveMQ code-injection flaw (CVE-2026-34197).
Read more → -
Johnson Controls EasyIO FG
EasyIO FG firmware up to version 2.0b52 contains hard-coded credentials and lacks a patch because the product is end-of-life. No firmware update will be released.
Read more → -
Hitachi Energy Asset Suite
Asset Suite versions 9.9.0 and earlier allow unauthenticated access to the HTTPPublishAdapterTestServlet. Upgrade to 9.9.1 or disable the servlet to mitigate.
Read more → -
Hitachi Energy REB500
REB500 versions 8.3.3.1 and earlier are vulnerable to denial-of-service via libexpat flaws.
Read more → -
CISA KEV — Citrix NetScaler (CVE-2026-88779)
CVE-2026-88779 targets Citrix NetScaler appliances and is listed as a known exploited vulnerability.
Read more → -
CISA KEV — Zammad GmbH Zammad Session Fixation (CVE-2026-102489) +1 more
CISA added CVE-2026-102489 and CVE-2026-102490 for Zammad to the KEV Catalog, indicating active exploitation.
Read more → -
CISA KEV — Fortinet FortiMail (CVE-2026-104286)
FortiMail path traversal vulnerability (CVE-2026-104286) has been added to CISA’s KEV catalog.
Read more → -
CISA Malcolm
Versions of CISA Malcolm earlier than 26.06.0 are listed as affected. The advisory reports that unauthenticated attackers can craft links that execute arbitrary script.
Read more → -
Johnson Controls EasyIO Neo Series EC and CW Controllers
Versions V3.3b62, V3.3b63, V3.3b24, and V3.3b25 transmit credentials and session data in cleartext.
Read more → -
ABB Protection and Control IED Manager PCM600
PCM600 versions up to 2.14 permit local users to elevate privileges via the Scheduler Service.
Read more → -
Meari IoT Cloud Platform OpenAPI Service
All versions of Meari IoT Cloud Platform OpenAPI Service are affected by missing-authorization vulnerabilities.
Read more → -
Johnson Controls EasyIO Neo Series EC and CW Controllers
Firmware versions V3.3b62, V3.3b63 (EC) and V3.3b24, V3.3b25 (CW) are identified as vulnerable.
Read more → -
Monta monta.app
All versions of Monta monta.app are affected. Unauthenticated WebSocket endpoints allow attackers to impersonate charging stations.
Read more → -
Armatura LLC Armatura One
Armatura One versions prior to 4.7.2 expose an unauthenticated ActiveMQ OpenWire listener.
Read more → -
CISA Adds One Known Exploited Vulnerability to Catalog
Cisco Catalyst SD-WAN Manager is listed in CISA’s KEV catalog due to active exploitation of CVE-2026-76504.
Read more → -
CISA KEV — Apple Multiple Products (CVE-2026-86950)
CISA added CVE-2026-86950, an out-of-bounds write bug affecting multiple Apple products, to the KEV catalog. The advisory urges rapid remediation on publicly exposed assets.
Read more → -
Lantronix G520 Series Cellular Gateway
Lantronix G520 Series Cellular Gateway version 2.6.0.4R6_stable is vulnerable to remote code execution via its update mechanism.
Read more → -
Toptech TMS7 and TopHAT
Toptech TMS7 and TopHAT version 7.6.3 are vulnerable to unauthenticated database export. The vendor released version 7.8 that resolves the issues.
Read more → -
Viidure Dashcam Android Application
The advisory reports that the dashcam platform’s cloud storage bucket is publicly readable, exposing user data and firmware.
Read more → -
Anjvision YSSD-RTMP-H5
Firmware 3.3.2.4_build_2024-12-26 of the Anjvision YSSD-RTMP-H5 is listed as affected.
Read more → -
VIVOTEK Camera Firmware
Remote command execution with root privileges is possible on the listed VIVOTEK camera firmware versions.
Read more → -
MikroTik RouterOS
RouterOS versions prior to 7.24 contain an unauthenticated integer underflow in the web management service.
Read more → -
Baicells Nova 430H
Unauthenticated devices within radio range can send malformed uplink messages that may cause a denial-of-service condition on the eNodeB. The issue affects Nova 430H eNodeB firmware versions up to BaiBLQ_3.0.12.
Read more → -
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
CVE-2026-88771 and CVE-2026-88772 are critical zero-day flaws in Citrix NetScaler ADC and Gateway that enable remote code execution.
Read more → -
CISA KEV — Citrix NetScaler (CVE-2026-88771) +1 more
Two Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) have been added to CISA’s Known Exploited Vulnerabilities catalog.
Read more → -
CISA KEV — WordPress Core Remote File Inclusion (CVE-2026-87902)
WordPress core versions vulnerable to CVE-2026-87902 have been added to CISA’s KEV catalog. The vulnerability is a remote file inclusion that is actively exploited.
Read more → -
CISA KEV — Microsoft SharePoint (CVE-2026-65660) +1 more
Microsoft SharePoint and Mikrotik RouterOS have been added to the KEV catalog due to active exploitation.
Read more → -
CISA KEV — WSO2 Multiple Products (CVE-2026-5430) +1 more
CISA added CVE-2026-5430 (WSO2 path-traversal) and CVE-2026-71362 (Adobe Commerce/Magento incorrect-authorization) to its KEV Catalog.
Read more → -
Eufy Omni C20, Omni X10 Pro
Versions earlier than 1.6.4 of the Eufy Omni C20 and Omni X10 Pro are vulnerable to command injection and hard-coded credentials.
Read more → -
Botslab G980H Dashcams
Botslab G980H dashcams (firmware series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+) are identified as vulnerable. The advisory notes multiple CVEs allowing authentication bypass and device manipulation.
Read more → -
Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
The fact sheet advises applying the principle of least privilege to third-party ICS integrators.
Read more → -
CISA KEV — Check Point Multiple Products (CVE-2026-85102) +3 more
Four CVEs affecting Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM have been added to the KEV catalog. The catalog addition signals active exploitation of these flaws.
Read more → -
lwIP TCP/IP Stack MQTT Client Application
lwIP MQTT Client Application versions 2.0.1 through 2.2.1 are vulnerable to an out-of-bounds write.
Read more → -
Siemens Siveillance Control
The OIS web module in Siemens Siveillance Control permits arbitrary file upload, which can lead to root-level compromise. Siemens provides patches that update the OIS component to fixed versions.
Read more → -
Siemens SIMOVE Fleetmanager and SIPLANT
Siemens SIMOVE Fleetmanager and SIPLANT are vulnerable to a relative path-traversal flaw (CVE-2026-67367). Siemens has published newer versions and advises updating to the latest releases.
Read more → -
Siemens Desigo CC family
Siemens Desigo CC V6 and V7 can execute embedded scripts in user-defined graphics, enabling client-side code execution.
Read more → -
Siemens SIPLUS and SIMATIC Products
Multiple Siemens SIPLUS and SIMATIC products are listed as vulnerable to CVE-2026-31431. Siemens has released newer software versions and advises updating to the latest releases.
Read more → -
Siemens WTV676 and WTV776
Unauthenticated attackers can force the devices into protection mode, disabling web access. Siemens advises updating to the latest Web Interface versions.
Read more → -
lwIP (Lightweight IP)
lwIP versions 2.0.1 through 2.2.1 are affected by a double-free vulnerability (CVE-2026-91018).
Read more → -
OpenPLC Runtime v3
OpenPLC Runtime v3 (CVE-2026-88020) is vulnerable to a reflected XSS that can hijack session cookies and issue state-changing requests. The vendor has declared v3 end-of-life and advises upgrading to v4.
Read more → -
Siemens Industrial Edge Management
Siemens Industrial Edge Management versions prior to 1.15.20, 2.2.2, and 2.9.1 are vulnerable to an unauthenticated credential reset (CVE-2026-18963). Siemens recommends updating to the latest releases to remediate the issue.
Read more → -
CISA KEV — Zyxel GS1900 Series Switches (CVE-2026-7273)
CVE-2026-7273 is a stack-based buffer overflow in Zyxel GS1900 series switches added to CISA's KEV catalog.
Read more → -
CISA KEV — Linux Kernel (CVE-2025-39682)
CISA added CVE-2025-39682, a Linux kernel improper-check vulnerability, to the KEV catalog. The flaw is actively exploited and prioritized for rapid remediation.
Read more → -
CISA KEV — Linux Kernel (CVE-2025-39964) +1 more
CISA added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to the KEV Catalog due to active exploitation.
Read more → -
ABB Ability Edgenius
ABB Ability Edgenius versions 3.2.0.0 through 3.2.4.0 are listed as affected by CVE-2026-31431. ABB provides an update to version 3.2.4.1 that resolves the issue.
Read more → -
Schneider Electric PowerChute Serial Shutdown
Versions ≤1.5 and 1.6 of PowerChute Serial Shutdown are vulnerable to CVE-2026-13348.
Read more → -
Schneider Electric Modicon M340 Controller and Communication Modules
The advisory reports a denial-of-service vulnerability in Schneider Electric Modicon M340 controllers and several communication modules.
Read more → -
Schneider Electric NetBotz 5 750/755
NetBotz 5 750/755 devices running firmware 5.5.2 or earlier are vulnerable to OS command injection and Hibernate SQL injection.
Read more → -
Bransys ELD
Bransys ELD versions prior to Android 11.00.00 and iOS 1.1.54 contain hard-coded MQTT credentials and transmit data in cleartext. These flaws could let an attacker read telemetry data and firmware.
Read more → -
Hitachi Energy FACTS Control Platform (FCP)
Hitachi Energy FACTS Control Platform versions 3.4.0 through 4.1.1 with the GWS component are vulnerable, scoring 9.9 CVSS.
Read more → -
Mitsubishi Electric GX Works3 and Motion Control Settings
All versions of Mitsubishi Electric GX Works3 and Motion Control Settings are affected by CVE-2026-15688. A local attacker can bypass the block password and modify the program memory.
Read more → -
CISA KEV — Cisco Identity Services Engine (CVE-2026-76460) +1 more
Cisco Identity Services Engine and Acronis Backup have been added to CISA’s Known Exploited Vulnerabilities catalog.
Read more → -
Using Cyber Decoys to Strengthen Detection and Response
Cyber decoys provide high-fidelity alerts that can reveal adversaries using legitimate credentials and living-off-the-land tools.
Read more → -
CISA KEV — Google Pixel (CVE-2026-58704)
CISA added CVE-2026-58704, an improper authorization vulnerability affecting Google Pixel devices, to its Known Exploited Vulnerabilities catalog.
Read more → -
CareCam CM2507
CareCam CM2507 firmware v251211.1507 lacks authentication for its video streaming service, permitting unauthenticated retrieval of live video.
Read more → -
Siemens Reyrolle 7SR5
Versions of Siemens Reyrolle 7SR5 earlier than V2.70 contain multiple high-severity vulnerabilities. Siemens provides an update to V2.70 or later.
Read more → -
Wärtsilä FOS-Onboard
Wärtsilä FOS-Onboard version 5.07.0923.01 contains hard-coded cryptographic keys. Wärtsilä has released a security patch for the issue.
Read more → -
Siemens Mendix SAML
Versions of Siemens Mendix SAML earlier than 4.2.3 (Mendix 10/11) or 3.6.27 (Mendix 9.24) are vulnerable to CVE-2026-80465. The flaw allows unauthenticated remote attackers to hijack a user session in specific SSO configurations.
Read more → -
Siemens Teamcenter
A reflected cross-site scripting vulnerability exists in the /auth/ redirect flow of Siemens Teamcenter.
Read more → -
Schneider Electric SCADAPack x70 Products
All listed SCADAPack x70 models are affected by CVE-2026-81861. The advisory recommends using RBAC instead of the Secure Lock feature.
Read more → -
mySCADA myPRO Manager
Versions ≤ 2.1 of mySCADA myPRO Manager lack authentication for privileged functions, allowing unauthenticated access.
Read more → -
Digital Watchdog VMAX DVR and NVR Product Lineups
All firmware versions of Digital Watchdog VMAX DVR and NVR models are listed as vulnerable. The vulnerabilities could give an unauthenticated attacker full administrative control.
Read more → -
Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
The report advises agencies and cloud providers to inventory and secure token validation and secret management processes. It emphasizes detection at scale for token misuse.
Read more → -
CISA KEV — Cisco Secure Email Gateway (CVE-2026-76461)
CVE-2026-76461 is a SQL injection vulnerability in Cisco Secure Email Gateway now listed in CISA’s KEV catalog.
Read more → -
CISA KEV — GitLab Community Edition and Enterprise Edition (CVE-2026-85706)
GitLab Community Edition and Enterprise Edition are listed in the KEV catalog for an actively exploited path-traversal flaw (CVE-2026-85706).
Read more → -
CISA KEV — JFrog Artifactory (CVE-2026-42016) +2 more
CISA added two JFrog Artifactory and one ConnectWise ScreenConnect CVEs to the KEV Catalog. The advisory notes they are actively exploited.
Read more → -
CISA KEV — MikroTik RouterOS (CVE-2026-67277) +1 more
CISA added two MikroTik RouterOS vulnerabilities to its KEV catalog.
Read more → -
AVEVA Pipeline Integrity Monitor
Versions of AVEVA Pipeline Integrity Monitor up to 2025 SP1 P1 build 7.1.9580.8513 are affected.
Read more → -
NextGen Healthcare Mirth Connect
Mirth Connect versions up to 4.7.1 are vulnerable to SQL injection and XXE flaws. The advisory recommends updating to version 4.7.2 or later.
Read more → -
Orthanc DICOM Server
Orthanc DICOM Server versions prior to 1.13.0 can be crashed via a crafted PNG or JPEG image.
Read more → -
CISA KEV — Fortinet Multiple Products (CVE-2025-25249) +3 more
Four actively exploited CVEs affecting Fortinet, Citrix NetScaler, Google Chromium V8, and Cisco FMC have been added to CISA’s KEV Catalog.
Read more → -
CISA KEV — Adobe Commerce and Magento (CVE-2026-75650) +3 more
Four CVEs affecting Adobe Commerce/Magento, Microsoft Windows, and N-able N-central have been added to CISA’s KEV Catalog.
Read more → -
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
China-based AI firms have extracted billions of tokens from U.S. frontier AI models via industrial-scale knowledge distillation.
Read more → -
CareCam Pro IP Cameras
The affected CareCam Pro IP Cameras use a hard-coded bootloader credential.
Read more → -
CISA KEV — Google Chromium V8 (CVE-2026-85046)
CISA added CVE-2026-85046, a type confusion vulnerability in Google Chromium V8, to its KEV catalog.
Read more → -
Pyramid Solutions NetStaX EtherNet/IP Stack
A large Class 3 explicit-message request can overflow the receive buffer, causing memory corruption or device crash.
Read more → -
IXON VPN Client
IXON VPN Client versions prior to 1.4.7 are vulnerable to CRLF injection that can lead to remote code execution with root or SYSTEM privileges.
Read more → -
Rockwell Automation ArmorStart LT
ArmorStart LT versions up to 2.001 are vulnerable to stored cross-site scripting.
Read more → -
Rockwell Automation ControlFLASH
ControlFLASH versions up to 15.07 grant write permissions to the Everyone group on the installation directory, enabling arbitrary code execution.
Read more →
Page 1 of 5 · 440 advisories