Aggregates CVE and security vulnerability intelligence across all coolercontrol-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk cross-site scripting and vendor risk command injection, with potential vendor impact session compromise across vendor surface software deployment use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-5302 | CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites | [email protected] | 6.3 | 0.03% | 2026-04-08 | 2026-04-16 |
| CVE-2026-5301 | Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries | [email protected] | 7.6 | 0.02% | 2026-04-08 | 2026-04-16 |
| CVE-2026-5300 | Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests | [email protected] | 5.9 | 0.01% | 2026-04-08 | 2026-04-16 |
| CVE-2026-5208 | Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names | [email protected] | 8.2 | 0.37% | 2026-04-08 | 2026-04-16 |