MagicMirrorOrg MagicMirror

• CVE-2026-63640 Medium 4.3 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables 0.3%
• CVE-2026-63642 Medium 6.3 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery 0.5%
• CVE-2026-63643 Medium 6.3 MagicMirror: ssrf calendar .js 0.7%
• CVE-2026-63641 Low 2.3 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions 0.4%
• CVE-2026-42281 Critical 9.2 MagicMirror²: Unauthenticated SSRF via /cors endpoint 1.6%