Jhuckaby Cronicle vulnerabilities
- jhuckaby cronicle Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 9.0 Critical
- jhuckaby cronicle Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401 8.8 High
- jhuckaby cronicle Cronicle: Stored XSS in admin Activity Log via account full_name field 9.0 Critical
- cronicle Privilege Escalation via update_event Job Output in Cronicle 5.3 Medium
- cronicle Stored XSS via Job HTML/Table Output in Cronicle 5.3 Medium