Version history
Release notes
What has changed on IACS Radar, from the first release until now, combined per week. Version numbering has been assigned retroactively to the existing development history.
v2.22.1
Current version
Week 45 · 2026New feature2 November 2026 – 5 November 2026v2.18.0 – v2.22.1
Next.js security updatev2.22.1
- Next.js has been updated from 16.3.6 to 16.4.5, which includes fixes for, among others, two critical vulnerabilities (GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr). sharp, zod and source-map-js have also been updated to versions without known vulnerabilities.
Visitor statistics with Umamiv2.22.0
- For a clearer picture of visits, Umami now also runs on the site's own server: a small counting script without cookies that does not store IP addresses and respects 'Do Not Track'. The privacy statement has been updated.
Visitor statistics without cookiesv2.21.0
- IACS Radar now counts visits without cookies, without a tracking script and without a third-party analytics service: the web server keeps a log with shortened IP addresses, from which the server itself produces an overview. The privacy statement describes what is logged and for how long.
Release notes per weekv2.20.1
- The release notes are now combined per calendar week: one block per week, containing the individual versions and their changes.
Cybersecurity news on the homepagev2.20.0
- Below the intro on the homepage, a row of current cybersecurity headlines from BleepingComputer, The Hacker News and Security.nl now scrolls by. A headline opens the article at the source in a new tab.
- The row pauses when you hover over it or use the button, and stands still (scrollable) if your system asks for reduced motion. The headlines are retrieved by the server; your browser only contacts the source when you click a headline.
Immediate notifications by text message toov2.19.0
- Immediate notifications (active exploitation or a critical advisory) can now also be sent by text message to a Dutch mobile number. You add your number on the management page and confirm it with a code.
- After confirming your subscription you go straight to the management page, where you set up immediate notifications and text messages.
Immediate email notifications on active exploitation and critical advisoriesv2.18.0
- In addition to the daily or weekly overview, you can get an email straight away, within an hour, as soon as something you follow is actively exploited (CISA KEV) or a critical advisory appears. At most one email per hour, and anything already reported straight away will not appear again in the overview.
- Use the link at the bottom of every email to manage your notifications: turn immediate notifications on or off, or unsubscribe.
Week 44 · 2026New feature26 October 2026 – 30 October 2026v2.12.2 – v2.17.0
Vulnerability disclosure policy (CVD)v2.17.0
- New page "Report a vulnerability" with the Coordinated Vulnerability Disclosure policy, following the NCSC guidelines: how to report, what we ask and what you can expect from us.
- security.txt now points to this policy and to the list of thanks, and its expiry date is updated automatically so the file never expires.
Email notificationsv2.16.0
- Receive a daily or weekly email with new CVEs, KEV entries and advisories for everything you follow in My Radar. Only when there is something new, and each item only once.
- Signing up works with a confirmation email; you can unsubscribe with one click at the bottom of every email or from your mail program. Your email address and selection are then deleted immediately.
- New privacy statement: which data IACS Radar stores, for what purpose and for how long.
Notifications via RSS, a faster site and more than twenty new sourcesv2.15.0
- Follow new vulnerabilities without opening the site: every vendor and product now has an RSS feed, and My Radar provides a feed of everything you follow. A feed contains new CVEs, CVEs added to the CISA KEV list and new or updated advisories. Works in Outlook, Feedly and the Teams RSS app.
- After a restart or update the site is available again within seconds instead of minutes: the most recently built catalogue is kept and shown straight away while a new one is built in the background. Pages are lighter: My Radar from 8.6 to 1.6 MB, the Asset Matcher from 8.6 to 2.4 MB and the dashboard from 2.3 to 1.0 MB. ICS Advisories shows 25 advisories per page (from 5.6 to 0.3 MB).
- New sources: the CSAF advisories of Schneider Electric and SICK, and via CERT@VDE those of 20 additional OT vendors, including Phoenix Contact, CODESYS, Pilz, Festo, Pepperl+Fuchs, Weidmüller, Endress+Hauser and Beckhoff.
- If NCSC-NL covers a CVE, the CVE page shows that advisory with the Dutch assessment of likelihood and impact.
- The period filter on the dashboard (24 hours, 7, 30 or 90 days) counted from a fixed date in July instead of from today.
Welotec advisories and a clearer WAGO product listv2.14.0
- Welotec's security advisories now come in directly via the CSAF feed that Welotec publishes at CERT@VDE, including the advisories on SmartEMS (VDE-2025-085 and VDE-2026-127).
- WAGO products are grouped per product series (PFC100, PFC200, PFC300, CC100, TP600, 750 Fieldbus Controller and so on) instead of per article number or subtype. Welotec devices are shown per series in the same way.
- Vendors that appear in the sources under different spellings or legal forms (for example "WAGO GmbH & Co. KG" and "WAGO") now appear as a single vendor.
WAGO advisories directly from WAGOv2.13.0
- IACS Radar now retrieves WAGO's security advisories directly: from the CSAF feed that WAGO publishes via CERT@VDE, and for new advisories not yet listed there, from the WAGO Download Center. This means that, for example, VDE-2026-132 (PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619) now appears on the site.
- A WAGO advisory often covers a whole range of controllers. The CVEs are now linked to every product family mentioned (for example CC100, PFC200 G2 and PFC300), so you can follow them per product in My Radar.
- Version ranges in CSAF's vers notation (for example vers:semver/>=1.0.0|<4.10.0) are now read correctly, including when the firmware is installed on a device.
- A CVE in a shared component, such as PHP, is now linked to every vendor and product from the advisories that mention it. Previously such a CVE was only listed under the vendor of the first advisory (for example Siemens instead of WAGO as well).
- The limit of 1000 advisory CVEs is now divided fairly across the advisories. Previously, a few large Siemens advisories with many CVEs from third-party components filled the limit, so CVEs from other advisories were dropped.
Citrix no longer includedv2.12.3
- Citrix (NetScaler) has been removed as a vendor: its products are mainly IT-oriented and fall outside the scope of IACS Radar. They were included because "Gateway" in NetScaler Gateway resembled an industrial protocol gateway.
Windows KEVs restored and Welotec product line updatedv2.12.2
- KEV entries without a related advisory, including all Windows vulnerabilities, fell outside the 1000-CVE limit because the advisories already filled it. KEV entries no longer count towards that limit and are always included.
- Windows vulnerabilities in recent versions (such as Windows 10 22H2, Windows 11 24H2 and Windows Server 2025) are now linked to the correct edition instead of the generic product "Windows".
- The Welotec products have been replaced by the current line for digital substations: RSAVP, RSAPC (Mk2), RSAEC (Mk2), RedFox-5728, Lynx switches and the HSR/PRP RedBox-DAN network card.
Week 43 · 2026New feature23 October 2026 – 24 October 2026v2.12.0 – v2.12.1
Fewer "Unknown product" entries for new CVEsv2.12.1
- If NVD has not yet analysed a new CVE, the product name now comes from the CVE record the vendor itself publishes at CVE.org (for example Hitachi Energy Asset Suite or Moxa MGate MB3170 Series). Only if that is missing too is the description used.
CVE descriptions automatically translatedv2.12.0
- In the Dutch and German versions, English CVE descriptions are now automatically translated with DeepL. The translation appears at the top of the CVE page and is marked as such; the original text remains visible under Original source information.
- For a new CVE without product data in NVD, the product name is now taken from the description (for example Fortinet FortiSIEM) instead of "Unknown product".
Week 40 · 2026New feature2 October 2026 – 4 October 2026v2.9.0 – v2.11.0
New CVEs visible sooner and CVSS 4.0 supportv2.11.0
- Each vendor now also shows the CVEs that the vendor's own CNA has published in the last 30 days, without waiting for inclusion in KEV, an ICS advisory or analysis by NIST.
- CVEs with only a CVSS 4.0 score were previously skipped; they are now included and shown as CVSS 4.0 on the detail page.
Dimmed mode: an option between light and darkv2.10.0
- Alongside light and dark mode there is now a dimmed mode: slate-grey surfaces with light text, calmer than white and less heavy than dark mode. Choose it via the theme icon at the top right.
- All text and status colours in dimmed mode have been checked for sufficient contrast (at least 4.5:1); the exposure map also has its own dimmed colour scheme.
Historical top-up for vendors with few reportsv2.9.0
- Vendors with fewer than five vulnerabilities are topped up to five: first with their most recent older KEV entries from the full CISA catalogue, then with the most recent CVEs from NVD.
- Added vulnerabilities are marked as "Historical" on the vendor page, with the year of publication; the methodology page describes the approach.
Week 39 · 2026New feature21 September 2026 – 23 September 2026v2.8.0 – v2.8.1
Automatic language selection on first visitv2.8.1
- Visitors with a German browser language now open IACS Radar in German, and visitors with any other non-Dutch browser language in English; Dutch browsers stay on Dutch.
- As soon as you choose a language yourself via the flag, that choice is remembered in a functional cookie and the automatic selection no longer intervenes. Search engines are not redirected.
English and German, and light mode by defaultv2.8.0
- IACS Radar is now available in Dutch, English and German. Choose your language via the flag at the top right; Dutch remains the default language and has no language prefix in the URL (/en/… and /de/… for the other languages).
- All interface texts, data descriptions, dates and numbers follow the chosen language; if a translation is missing somewhere, Dutch is shown instead of a blank.
- All knowledge base and blog articles are now also available in English and German.
- Search engines get hreflang references to all language variants per page, including in the sitemap.
- The site now opens in light mode by default; use the sun/moon button to switch to dark and your choice is remembered.
Week 37 · 2026New feature9 September 2026v2.7.0
Asset Matcher: firmware-version-aware matchingv2.7.0
- Asset Matcher now assesses whether your specifically installed firmware/software version actually falls within a known vulnerable range, instead of only reporting that a product has vulnerabilities — with a concrete recommended action (e.g. "upgrade to V9.80 or newer") where the source indicates one.
- With insufficient or unclear version information, Asset Matcher always shows an explicit intermediate status ("Possibly vulnerable", "Firmware version needed") — never a reassuring "safe" based on uncertain data.
- Assets can now be edited inline (vendor, product, version, zone, criticality) instead of deleting and re-adding them.
- Better automatic recognition of vendor names, including with deviating legal forms ("Siemens AG", "Mitsubishi Electric Corporation").
- Zone and criticality now count towards the Asset Priority, alongside the existing IACS Radar Score.
- CSV import now shows a preview of recognised/ignored columns before final import, and supports new columns (model, zone, criticality, asset name).
Week 36 · 2026New feature1 September 2026 – 3 September 2026v2.4.0 – v2.6.6
Illustrations per blog categoryv2.6.6
- Every blog article now has a banner illustration (blog list and article page), in its own colour and motif per category — not a photo (no royalty-free source available), but a custom-made illustration in the same style as the homepage hero.
v2.6.5
- My Radar: "Follow a vendor, product or CVE" now sits directly below the export/import buttons, before the "Nothing to follow yet" message.
Website links for automatically recognised vendorsv2.6.4
- Vendors recognised only via a live CISA/NVD integration (not from the manual list) never had a website link — 28 of them now have a verified official address; the rest get a clearly labelled search link instead of nothing.
WAGO added, non-industrial CISA advisories filteredv2.6.3
- WAGO added as a vendor (PFC200 series).
- CISA ICS advisories outside OT-relevant critical infrastructure sectors (e.g. consumer vehicle security) no longer appear as a vendor/vulnerability — CISA publishes those under the same advisory feed as real OT/energy-sector advisories.
Terms of use and attributionv2.6.2
- New Terms of use page (via the About menu or the footer) with the mandatory NVD attribution notice and attribution for CISA, Siemens, ABB, FIRST.org (EPSS) and Shodan.
- New, valid NVD API key activated — the previous one was rejected by NVD, which silently dropped NVD enrichment (including all Microsoft Windows CVEs).
More reliable vulnerability data refreshv2.6.1
- The site could temporarily hang for minutes when refreshing vulnerability data (NVD/EPSS) — batches are now fetched in parallel instead of one after another, and the result is cached reliably so visitors never again wait for a full recalculation.
- Full Microsoft Windows CVE coverage restored, after a temporary restriction yesterday because of this same performance problem.
Help page with a short guide per sectionv2.6.0
- New Help page (via the About menu or the footer) with a short explanation per section: dashboard, My Radar, Intelligence, vendors/products, Asset Matcher, prioritisation and preferences.
- Release notes is now also in the main menu under "About", no longer only in the footer.
Microsoft Windows added as a vendorv2.5.0
- Microsoft Windows added to the vendor/product catalogue (Windows XP, 7, 10, 11 and Server) — relevant because substations increasingly use Windows thin clients and workstations as a gateway to an HMI.
- Vulnerabilities only come in for core operating system components that are in the CISA KEV catalogue (confirmed actively exploited), not for Microsoft applications or the full CVE inflow.
Take your watchlist to another browserv2.4.0
- My Radar: the watchlist can now be exported/imported as a file, or shared via a link — handy on another browser, device, or after clearing cache/cookies.
Week 35 · 2026New feature24 August 2026 – 26 August 2026v2.2.0 – v2.3.0
Simulated attack patterns on the exposure mapv2.3.0
- New, optional visualisation on the exposure map that shows illustrative attack patterns (clearly labelled as a simulation, no live threat data) — enabled by default.
- Hero and header reduced in size so the exposure map is immediately in view on a first visit.
- Dark mode made a few shades lighter.
Vendor fixesv2.2.1
- The link to the official source on vendor advisories now points to the readable page instead of a raw JSON file.
- Fortinet, Welotec and Westermo added to the vendor and product catalogue.
- Vendors without a current vulnerability were wrongly missing from the vendor overview — fixed, with sort options (alphabetical / number of vulnerabilities) added.
Redesigned zones & conduits, dark mode as defaultv2.2.0
- The interactive "zones and conduits" visualisation redesigned in a professional OT architecture style, with explanation.
- Dark mode is now the default view.
- Main menu restructured: Asset Matcher directly in the main menu, Vulnerabilities and ICS Advisories moved to Intelligence.
- My Radar, Intelligence and the CVE detail page aligned to the same width as the rest of the site.
Week 34 · 2026New feature17 August 2026 – 23 August 2026v2.1.0 – v2.1.2
v2.1.2
- Contact options (LinkedIn, email) added to the About page.
v2.1.1
- Explanation "How the vulnerability list is compiled" simplified and the accompanying diagram rebuilt as a clear 4-step infographic.
- Two findings from the OWASP security assessment resolved.
- My Radar now shows the full product catalogue, instead of only products with a current vulnerability.
Vendor and product pages, Asset Matcherv2.1.0
- Own pages per vendor and product added.
- Asset Matcher introduced: match your own equipment locally in the browser against the vulnerability catalogue.
- Abbreviations page added.
- Various texts on the methodology page clarified and findings from an external website scan resolved.
Week 33 · 2026Major release16 August 2026v2.0.0
My Radar, EPSS and live vendor feedsv2.0.0
- "My Radar" introduced: follow vendors, products or CVEs and see in one overview what has changed since your last visit.
- EPSS (Exploit Prediction Scoring System) added to the OT priority score.
- Live vendor advisories from Siemens ProductCERT and ABB PSIRT added.
- Filter options added to ICS advisories, as with Vulnerabilities.
- CVE detail page restructured and a data consistency error between dashboard and detail pages resolved.
- New knowledge base article on the Cybersecurity Act and IEC 62443.
Week 32 · 2026Improvement9 August 2026v1.3.2
v1.3.2
- 404 error fixed when clicking through from intelligence feed items on the dashboard.
- Default period filter on the dashboard extended from 30 to 90 days.
- Text alignment on the homepage improved.
Week 31 · 2026New feature27 July 2026 – 1 August 2026v1.2.0 – v1.3.1
v1.3.1
- Browser tab title fixed (showed "Dashboard" instead of "IACS Radar").
- Payoff text aligned pixel-perfectly with the logo in the header.
v1.3.0
- Visual explanation of the CVE compilation methodology added to the Methodology page.
- New logo (header and favicon) and USP text on the homepage.
- Explanation added of what makes IACS Radar different, on the About page.
v1.2.2
- Site verification added for Bing Webmaster Tools.
- More contrast between the exposure map and the page background in light mode.
v1.2.1
- robots.txt and sitemap.xml added for better discoverability in search engines.
New lookv1.2.0
- Completely new, NCSC-inspired design: institutional header, hero and dashboard layout.
- The IACS Radar logo added to the header.
- The search function now also searches the knowledge base, blog and IEC 62443 content.
Week 30 · 2026Major release24 July 2026 – 26 July 2026v1.0.0 – v1.1.1
v1.1.1
- Subtle heartbeat animation added on the selected country circle of the exposure map.
Dashboard redesignv1.1.0
- Dashboard rebuilt: map-first layout with sidebar navigation, KPI sparklines and clearer status messages.
- Netherlands as the default country and light mode as the default theme.
- Security tightened (Content-Security-Policy without inline scripts).
- Various data bugs fixed: exposure figures per country, a Shodan error that kept most countries at 0, and time zone handling.
First releasev1.0.0
- IACS Radar live: dashboard with exposure map, vulnerabilities, KEV matches, ICS advisories and methodology.
- Production environment set up on a TransIP VPS.