CVE-2026-39401 Privilege Escalation via update_event Job Output in Cronicle

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privile...

CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privile...

CVE-2026-39401

Cronicle prior to 0.9.111 is affected by CVE-2026-39401. The vulnerability arises when jb child processes can include an update_event key in their JSON output, which the server applies directly to the parent event’s stored configuration without authorization. A low-privilege user who can create a...

CVE-2026-39401 Privilege Escalation via update_event Job Output in Cronicle

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privile...

EUVD-2026-19925

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privile...

CVE-2026-39401 Privilege Escalation via update_event Job Output in Cronicle

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an updateevent key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privile...

CVE-2026-39400 Stored XSS via Job HTML/Table Output in Cronicle

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with createevents and runevents privileges can inject arbitrary JavaScript through job output fields html.content, html.title, table.header, table.rows, table.caption. The serve...

GHSA-RX8C-J7X8-W3HJ

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:57+00:00| seen| Telegram/R04Jnimv0i8bRzdrQmyXdIyX4oD8CszgjzD3ZP34LCmicTY...

GHSA-7FR4-MVFM-CXFX

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:49+00:00| seen| Telegram/KxTaYuDzH0Z1i49WRh0FHus2MwhOECzgEb0vJJCyVaWiEf0...

CVE-2026-39343

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:49+00:00| seen| Telegram/KxTaYuDzH0Z1i49WRh0FHus2MwhOECzgEb0vJJCyVaWiEf0 2026-04-13 00:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjdl3qnmlq22...

GHSA-XQ86-JH52-728G

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:33+00:00| seen| Telegram/MwNatB1kDaoxbSrZihFWwC12FE1HreAtxbr2hmQcZTjcFY...

GHSA-VMFG-C69G-M8P8

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:16+00:00| seen| Telegram/yEepCm2Odjvpf0uI90hS1hr8dhkmidpoORZ8hNAmW5Xwfo...

GHSA-VG4M-HC29-JGQJ

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:16+00:00| seen| Telegram/yEepCm2Odjvpf0uI90hS1hr8dhkmidpoORZ8hNAmW5Xwfo...

GHSA-H7HG-F7CW-9XWC

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:16+00:00| seen| Telegram/yEepCm2Odjvpf0uI90hS1hr8dhkmidpoORZ8hNAmW5Xwfo...

GHSA-8HWW-W7CC-77RJ

creationtimestamp| type| source ---|---|--- 2026-04-07 19:34:12+00:00| seen| Telegram/RceOsMbVCcV6wQMI9eJfY-7gRIWU138I3ZVebAFZlOd7ZE...

GHSA-7526-J432-6PPP

creationtimestamp| type| source ---|---|--- 2026-04-07 19:34:12+00:00| seen| Telegram/RceOsMbVCcV6wQMI9eJfY-7gRIWU138I3ZVebAFZlOd7ZE...

GHSA-583G-FG76-FHFR

creationtimestamp| type| source ---|---|--- 2026-04-07 19:34:12+00:00| seen| Telegram/RceOsMbVCcV6wQMI9eJfY-7gRIWU138I3ZVebAFZlOd7ZE...

GHSA-3G6G-GQ4R-XJM9

creationtimestamp| type| source ---|---|--- 2026-04-07 19:33:54+00:00| seen| Telegram/2sVgvXJxKnqdd0t3ix7z2PFFoP4qMIqNMJ7HHwXtd94aJL4...

CVE-2026-39329

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

Summary Before OpenClaw 2026.4.2, Zalo webhook replay dedupe keys were not scoped strongly enough across chat and sender dimensions. Legitimate events from different conversations or senders could collide and be dropped as duplicates. Impact Cross-conversation or cross-sender collisions could cau...