SSRF flaws CVE-2026-63642 and CVE-2026-63643 in MagicMirror² newsfeed and calendar modules, fixed in 2.37.0
The Yokai Research Team at Hakai Security disclosed two Server-Side Request Forgery (SSRF) vulnerabilities in MagicMirror², an open-source smart mirror platform: CVE-2026-63642 (blind SSRF in the newsfeed module) and CVE-2026-63643 (SSRF in the calendar module). Both let a client make the MagicMirror² server send HTTP requests to attacker…