jhuckaby Cronicle

• CVE-2026-85076 Critical 9.0 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 0.4%
• CVE-2026-58255 High 8.8 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401 0.4%
• CVE-2026-55562 Critical 9.0 Cronicle: Stored XSS in admin Activity Log via account full_name field 0.5%
• CVE-2026-39401 Medium 5.3 Privilege Escalation via update_event Job Output in Cronicle 0.2%
• CVE-2026-39400 Medium 5.3 Stored XSS via Job HTML/Table Output in Cronicle 0.2%