jhuckaby cronicle vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 9.0CVE-2026-85076EPSS 0.4%2026-11-05

   Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through a…

2. 8.8CVE-2026-58255EPSS 0.4%2026-10-27

   Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields …

3. 9.0CVE-2026-55562EPSS 0.5%2026-10-13

   Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into …