Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39400 Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges c… https://www.cve.org/CVERecord?id=CVE-2026-39400
Post summary
The post announces CVE-2026-39400, noting a Privilege Escalation flaw in Cronicle that allows non‑admin users to create and run events before v0.9.111, without mentioning PoC or patches.
CVE-2026-39400 Arbitrary JavaScript Injection in Cronicle Prior to Version 0.9.111 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39400 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The notice simply references a newly disclosed CVE with a brief vulnerability description and provides links to further information, but lacks details on exploitation, mitigation, or PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cronicle | cronicle | - | - | - |