4
CVEs
0
Critical
0
High
0
KEV
4
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
3
LOW
1
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-63643 | Server-side request forgery in MagicMirror² versions prior to 2.37.0 allows unauthenticated remote attackers to make the mirror server issue arbitrary outbound HTTP requests to attacker-controlled URLs, including to internal network services. The vulnerability stems from the ADD_CALENDAR handler on the unauthenticated Socket.IO /calendar namespace accepting a fully attacker-controlled URL, authentication headers, and a TLS-bypass flag with no SSRF validation. When the internal target returns valid iCal data, the parsed event content is returned to the attacker via CALENDAR_EVENTS, enabling blind-to-semi-open SSRF with data exfiltration. A working proof-of-concept (exploit-ssrf-calendar.js) is documented in the GHSA advisory; no CISA KEV listing at time of analysis. | MEDIUM | 6.3 | 0.5% | 52 |
PoC
|
| CVE-2026-63642 | Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported. | MEDIUM | 6.3 | 0.4% | 52 |
PoC
|
| CVE-2026-63640 | Secret environment variable disclosure in MagicMirror² before 2.37.0 allows adjacent network attackers to recover live SECRET_* credential values by exploiting a logic inversion in the socket dispatcher. The hideConfigSecrets feature is intended to redact environment secrets from browser-facing config responses, but the node_helper socket catch-all unconditionally expands **SECRET_NAME** placeholders in every inbound payload before routing to module helpers. Any unauthenticated client connected to a module namespace (such as the default weather helper) can submit a crafted INIT_WEATHER payload embedding a secret placeholder and receive the expanded real secret value echoed back in the WEATHER_ERROR response. No public exploit has been identified at time of analysis, and a vendor-released patch is available as of version 2.37.0. | MEDIUM | 4.3 | 0.2% | 42 |
PoC
|
| CVE-2026-63641 | Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clients to interact directly with module helpers, bypassing the configured ipWhitelist that protects only the Express HTTP layer. Affected deployments binding to non-loopback interfaces can be exploited for server-side request forgery via the default newsfeed and calendar helpers, and conditionally for command execution via child_process.exec through the updatenotification helper when a third-party module update is pending. No public exploit code has been identified at time of analysis and this vulnerability is not in CISA KEV. | LOW | 2.3 | 0.3% | 32 |
PoC
|