CoolerControl vulnerabilities
4 known CVE vulnerabilities in CoolerControl, translated and rated.
- CVE-2026-5302Medium
CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.
- CVE-2026-5301High
In CoolerControl/coolercontrol-ui versions before 4.0.0, there is a Stored XSS vulnerability in the log viewer. Unauthenticated attackers can take over the service via malicious JavaScript in poisoned log entries.
- CVE-2026-5300Medium
In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.
- CVE-2026-5208High
In CoolerControl/coolercontrold before version 4.0.0, a command injection vulnerability in alerts allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names.