Coolercontrol Coolercontrold vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Coolercontrol Coolercontrold: 4 record(s), with affected versions and fixes.
cpe:2.3:a:coolercontrol:coolercontrold

CVE-2026-5302 High · 8.1 CWE-942 Apr 8, 2026

Permissive Cross-domain Policy with Untrusted Domains in coolercontrold

CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

CVE-2026-5301 Medium · 6.1 CWE-79 Apr 8, 2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui

Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries

CVE-2026-5300 Critical · 9.1 CWE-306 Apr 8, 2026

Missing Authentication for Critical Function in coolercontrold

Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests

CVE-2026-5208 High · 7.2 CWE-78 Apr 8, 2026

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names