These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-63643 is a vulnerability in MagicMirror², an open-source modular smart mirror platform. The issue allows an attacker to exfiltrate internal-service response data by sending a server-side request without proper SSRF validation. This vulnerability is fixed in version 2.37.0. Affected deployments should be identified and assessed for exposure. The vulnerability allows an attacker to exfiltrate inter [truncated]
CVE-2026-63642 is a vulnerability in MagicMirror², an open-source modular smart mirror platform. The issue, fixed in version 2.37.0, allows unauthenticated attackers to use the CHECK_ARTICLE_URL notification through the Socket.IO namespace /newsfeed to perform a HEAD request to an attacker-controlled URL, potentially identifying internal hosts and ports and triggering side effects on services that react t [truncated]
CVE-2026-63641 is a low-severity vulnerability in MagicMirror², an open-source modular smart mirror platform. The issue arises from the lack of IP allowlist, origin, or namespace authentication checks for the Socket.IO server in js/server.js, which allows an unauthenticated adjacent-network client to connect directly to module Socket.IO namespaces. This can lead to server-side requests to attacker-selecte [truncated]
CVE-2026-63640 debrief: MagicMirror² vulnerability allows API token disclosure through a client-side socket dispatcher when hideConfigSecrets is enabled, impacting defenders who must assess exposure and prioritize remediation to version 2.37.0 or later, considering potential unauthorized access to sensitive information and the need for verification of affected versions and inventory. This vulnerability, t [truncated]
CVE-2026-42281 is a critical unauthenticated server-side request forgery (SSRF) vulnerability in MagicMirror²’s /cors endpoint. Before 2.36.0, a remote attacker could make the server issue arbitrary HTTP requests toward internal networks, localhost services, and cloud metadata endpoints. The endpoint also expands environment-variable placeholders (**VAR_NAME), which can expose server-side secrets. The iss [truncated]
