Cronicle vulnerabilities
CVEs whose affected-version data names the Cronicle package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-58255High· 8.8Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` field…
▾ Twilightjhuckaby · CronicleEPSS 0.41%via CVEORG
CVE-2026-55562Critical· 9.0PoCCronicle is a multi-server task scheduler and runner, with a web based front-end UI
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value int…
▾ Abyssaljhuckaby · CronicleEPSS 0.46%via NVD