馃毃 CVE-2026-121803 (9.3) 馃毃
Unisoc's UFS firmware update code lets any app on the device run code or crash the device with a malformed update.
UFS is a flash storage standard, and Field Firmware Update is how its firmware gets replaced. No fixed version is named.
When an app starts a firmware update, the driver walks a PRDT, a table listing the memory regions the firmware moves through. The table's size is never checked, so a longer table writes past the buffer into the memory after it, and any app can take control from there.
鈿狅笍 CVE-2026-121802 (9.1) 鈿狅笍
better-auth's Expo plugin lets an attacker change any account's email address without signing in.
Versions before 1.7.16 are affected. Upgrade to 1.7.16.
An Expo sign-in sends a state value, which the server is meant to issue. The plugin signs whatever state it's handed, never checking the server issued it. An attacker can send their own state and the server trusts it, so they can change another account's email.
鈿狅笍 CVE-2022-29966 (9.8) 鈿狅笍
Emerson Ovation, the industrial control system, lets anyone who can reach it change controller settings or knock it offline.
No affected versions or fixed release are named yet.
Ovation speaks several protocols that have no authentication step. A controller that accepts a connection acts on what it receives without checking who sent it. So anyone who can reach that network can change its configuration or knock it offline.
鈿狅笍 CVE-2026-121030 (9.6) 鈿狅笍
Google Chrome before 157.0.8103.38 can be tricked into running code outside its sandbox by a page an attacker gets you to open.
Chrome versions before 157.0.8103.38 are affected. Update to 157.0.8103.38 or later.
DevTools is Chrome's developer toolset, and it's meant to check who can ask it to do things. That check is wrong here, so a crafted HTML page can get through. The attacker still has to talk you into opening that page, and the code execution is only potential.
鈿狅笍 CVE-2026-112354 (9.8) 鈿狅笍
Etrel INCH charging stations let anyone who can reach the management web interface log in as Administrator with the factory-default account.
Firmware before 7.1.2 and before 8.0.1 is affected. Update to 7.1.2 or 8.0.1.
The web interface ships with a factory-default Administrator account, and its login page is plain HTTP. Anyone who can reach it signs in with the default username and password. They can read the charger's configuration and its management-system connection details.
鈿狅笍 CVE-2026-82158 (9.0) 鈿狅笍
Dell Wyse Management Suite, the console admins use to manage Wyse devices, lets a low-privileged user inject scripts that run in another admin's browser.
Versions before 2609.0.0.155 are affected. Upgrade to 2609.0.0.155 or later.
Cross-site scripting means the suite builds a page from input it never cleans, so text a low-privileged user supplies comes back to the browser as code. It runs in the session of whoever opens that page, usually an admin. The confirmed impact is script injection.
馃毃 CVE-2026-95731 (9.8) 馃毃
HPE Networking Fabric Composer lets an unauthenticated attacker log in to its command-line interface with a password baked into the software and get admin access.
No fixed version is named. Treat any reachable CLI as exposed.
The CLI asks for a username and password before it lets anyone in. But it ships with a password hardcoded into the software, the same on every install. An attacker who knows it can log in without an account and lands with admin rights.