Vulnerabilidades de CoolerControl
CVEs publicadas que afetam produtos de CoolerControl: 4 registro(s), com severidade, exploração e correções.
CVE-2026-5302
Alta · 8.1
CWE-942 08/04/2026
Permissive Cross-domain Policy with Untrusted Domains in coolercontrold
CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites
CVE-2026-5301
Média · 6.1
CWE-79 08/04/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui
Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries
CVE-2026-5300
Crítica · 9.1
CWE-306 08/04/2026
Missing Authentication for Critical Function in coolercontrold
Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests
CVE-2026-5208
Alta · 7.2
CWE-78 08/04/2026
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names