Legend: !important+added-removed~changed#fixed iCagenda™ is distributed under the terms of the GNU General Public License version 3 or later; see LICENSE.txt.
iCagenda 4.0.17 (2026.10.27) (Security Release)
!
High and medium Security Release.
#
[SECURITY][CVE-2026-102790][HIGHT] Fixed: Stored XSS via url-type event Custom Field.
#
[SECURITY][CVE-2026-102799][MEDIUM] Fixed: CSV formula injection in the registrations export.
These vulnerabilities were responsibly disclosed by Akinlabi Omoogun of lulztigre.pw.
I would like to thank Akinlabi for reporting these issues and for helping me strengthen the security of iCagenda.
