Vulnerabilities in MagicMirrorOrg

5 results

CVE-2026-42281CRITICALMagicMirror²: Unauthenticated SSRF via /cors endpointEPSS 1.6%CVE-2026-63643MEDIUMMagicMirror: ssrf calendar .jsEPSS 0.7%CVE-2026-63642MEDIUMMagicMirror newsfeed Socket.IO notification allows blind server-side request forgeryEPSS 0.5%CVE-2026-63641LOWMagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actionsEPSS 0.4%CVE-2026-63640MEDIUMMagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variablesEPSS 0.3%