Advisories · Technology
jhuckaby Cronicle.
Every CVE that names jhuckaby Cronicle among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.0 CriticalCritical · CVSS 9+
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
- jhuckaby Cronicle
- Other injection
- Broken access control
- CVSS 8.8 High
Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
- jhuckaby Cronicle
- Privilege escalation
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Cronicle: Stored XSS in admin Activity Log via account full_name field
- jhuckaby Cronicle
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Privilege Escalation via update_event Job Output in Cronicle
- jhuckaby Cronicle
- Broken access control
- CVSS 5.3 Medium
Stored XSS via Job HTML/Table Output in Cronicle
- jhuckaby Cronicle
- Cross-site scripting (XSS)