Back to the CVE list
CVE-2026-42281

Server-side request forgery in Magicmirror

CVSS score

8.6

EPSS probability

%1.6

Risk score

0.1

Published

5 mo ago

OverviewPublic Exploits (3)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
Astaruf/CVE-2026-42281
GitHub

CVE-2026-42281 - MagicMirror <= 2.35.0 - Unauthenticated SSRF via /cors endpoint (★0)

Public PoCSource updated: 01.05.2026 06:48:55
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42281.yaml
Nuclei

Nuclei: MagicMirror <= 2.35.0 - Server-Side Request Forgery

Exploit reference
G
MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq
GitHub

https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq

Exploit reference

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-42281"