Magicmirrororg

5 CVEs in 1 Magicmirrororg product, including Magicmirror. Newest: CVE-2026-63643 (2026-08-18). Severity, EPSS and public exploits for each.

Magicmirrororg products with known CVEs

ProductCVEs
Magicmirror5
Magicmirrororg CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-636432026-08-18MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an at…
CVE-2026-636422026-08-18MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTI…
CVE-2026-636412026-08-18MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO…
CVE-2026-63640Medium4.32026-08-18MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_he…
CVE-2026-42281High8.62026-05-14MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors…