CVE-2026-127082
Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server proces
CVSS
7.7
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-497
Sin historial EPSS suficiente todavía.
Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.
- github.comhttps://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jq_agent.rb#L166
- github.comhttps://github.com/huginn/huginn/commit/826f4bd471c027660b1951408b44f9e5c5452aff
- github.comhttps://github.com/huginn/huginn/releases/tag/v2026.11.09
- github.comhttps://github.com/huginn/huginn/security/advisories/GHSA-3f56-748g-q34j
- www.vulncheck.comhttps://www.vulncheck.com/advisories/huginn-before-2026.11.09-information-exposure-via-jqagent-jq-env-builtin
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1240115.3 MED—
——0XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.10hCVE-2026-961375.5 MED40.2%
——12Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.3dCVE-2026-960015.5 MED45.6%
——14Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.3dCVE-2026-1199424.7 MED32.1%
——10Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.3dCVE-2026-1198825.3 MED57.8%
——17Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.3dCVE-2026-1198565.5 MED42.7%
——13Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.6h