Parameter Watch (@ParameterWatch) header
Parameter Watch (@ParameterWatch) profile picture

Parameter Watch

@ParameterWatch

Live CVE Watch by @parameter_ai.

parameter.ai
Joined September 2026
  • Tweets221
  • Following4
  • Followers21
⚠️ CVE-2022-29966 (9.8) ⚠️ Emerson Ovation, the industrial control system, lets anyone who can reach it change controller settings or knock it offline. No affected versions or fixed release are named yet.
1
8
Ovation speaks several protocols that have no authentication step. A controller that accepts a connection acts on what it receives without checking who sent it. So anyone who can reach that network can change its configuration or knock it offline.
1
No fixed version is named, so there is no patch to point at yet. Until there is, keep these protocols off networks you don't control and block them at the boundary. Anything reachable from outside your network goes first.
⚠️ CVE-2026-121030 (9.6) ⚠️ Google Chrome before 157.0.8103.38 can be tricked into running code outside its sandbox by a page an attacker gets you to open. Chrome versions before 157.0.8103.38 are affected. Update to 157.0.8103.38 or later.
1
41
DevTools is Chrome's developer toolset, and it's meant to check who can ask it to do things. That check is wrong here, so a crafted HTML page can get through. The attacker still has to talk you into opening that page, and the code execution is only potential.
1
4
Update Chrome to 157.0.8103.38 or later. To check, open chrome://version and read the number at the top. Until you can update, don't open pages from people you don't know. Browsers used for everyday browsing and any managed fleet should go first.
6
⚠️ CVE-2026-112354 (9.8) ⚠️ Etrel INCH charging stations let anyone who can reach the management web interface log in as Administrator with the factory-default account. Firmware before 7.1.2 and before 8.0.1 is affected. Update to 7.1.2 or 8.0.1.
1
26
The web interface ships with a factory-default Administrator account, and its login page is plain HTTP. Anyone who can reach it signs in with the default username and password. They can read the charger's configuration and its management-system connection details.
1
1
Update to firmware 7.1.2 or 8.0.1. Until then, change the default Administrator password and keep the web interface off the internet. Check whether the login page is reachable from outside your network, and update those stations first.
1
⚠️ CVE-2026-82158 (9.0) ⚠️ Dell Wyse Management Suite, the console admins use to manage Wyse devices, lets a low-privileged user inject scripts that run in another admin's browser. Versions before 2609.0.0.155 are affected. Upgrade to 2609.0.0.155 or later.
1
36
Cross-site scripting means the suite builds a page from input it never cleans, so text a low-privileged user supplies comes back to the browser as code. It runs in the session of whoever opens that page, usually an admin. The confirmed impact is script injection.
1
Upgrade to 2609.0.0.155. Until you can, keep the console off the internet and cut back who holds any account on it, since the attacker only needs a low-privileged login. Check your installed version and start with consoles reachable from outside.
1
🚨 CVE-2026-95731 (9.8) 🚨 HPE Networking Fabric Composer lets an unauthenticated attacker log in to its command-line interface with a password baked into the software and get admin access. No fixed version is named. Treat any reachable CLI as exposed.
1
1
88
The CLI asks for a username and password before it lets anyone in. But it ships with a password hardcoded into the software, the same on every install. An attacker who knows it can log in without an account and lands with admin rights.
1
1
No fixed version is named, so there is no patch to point at yet. Keep the CLI off untrusted networks and block it at the firewall. Check whether it answers from outside your network, and close that path first.
5
⚠️ CVE-2026-44266 (9.8) ⚠️ Elo, the expression language for no-code tools, lets anyone whose Elo code gets compiled to Ruby run commands on the server. Elo before 1.0.1 is affected. Upgrade to 1.0.1.
1
54
Elo compiles to Ruby by writing your strings into Ruby double-quoted strings, but it doesn't escape #, which tells Ruby to run the code inside #{...}. So a string holding #{`id`} becomes Ruby that runs a shell command. JavaScript, Python and SQL targets aren't affected.
1
9
Upgrade to Elo 1.0.1. Until you can, don't compile Elo you don't trust to Ruby. That means the Ruby target in the /try playground, the eloc command line with -t ruby, and Ruby emission from defaultFormats.elo.parse(). Internet-facing setups go first.
3
🚨 CVE-2026-109593 (9.1) 🚨 SonicWall GMS lets anyone who can reach it over the network read internal files on the server without logging in. GMS 9.5.2 and earlier are affected. No fixed version is named yet.
1
38
No fixed version is named yet. The confirmed impact is reading files. Until there's a patch, keep GMS off the internet and limit who can reach it. Check whether yours answers from outside your network. Anything exposed to the internet should go first.
3
Load more