Magicmirrororg Magicmirror
5 CVEs affecting Magicmirrororg Magicmirror. Latest disclosed: 2026-08-18. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42281 | High | 8.6 | 2026-05-14 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors… |
CVE-2026-63640 | Medium | 4.3 | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_he… |
CVE-2026-63643 | | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an at… | |
CVE-2026-63642 | | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTI… | |
CVE-2026-63641 | | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO… |