Critical Alert 4 Active Exploits Detected Today

CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability →
CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability →
CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability →
CVE-2026-65400 Apple macOS Improper Authentication Vulnerability →
Powered by CVE Watchtower
×
August 19, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-63641NVD

Vulnerability Summary

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0.
Severity Level
UNKNOWN
Published Date
Aug 18, 2026
Last Modified
Aug 18, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
N/A