Jhuckaby vulnerabilities
We track 3 vulnerabilities in Jhuckaby products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest Jhuckaby vulnerabilities
- 9.0 Critical severity
Cronicle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_
- 8.8 High severity
Cronicle: Improper Privilege Management
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/cre
- 9.0 Critical severity
Cronicle: Improper Neutralization of Input During Web Page Generation
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying