CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

EUVD-2026-61079

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-66633

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-75854

creationtimestamp| type| source ---|---|--- 2026-08-18 12:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117116398789961703 2026-08-18 12:00:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mte666epzm2n 2026-08-18 12:30:04+00:00| seen|...

CVE-2026-67854

creationtimestamp| type| source ---|---|--- 2026-08-18 01:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtd2xndomb2w 2026-08-18 16:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtenadx26z25...

CVE-2026-59894

creationtimestamp| type| source ---|---|--- 2026-08-18 01:00:04+00:00| published-proof-of-concept| Telegram/GwuC3cy-OzU2KFCuHYMrTkUTBOKWE1Dd5EfEUwy3SR6M 2026-08-19 00:00:28+00:00| published-proof-of-concept| Telegram/GwuC3cy-OzU2KFCuHYMrTkUTBOKWE1Dd5EfEUwy3SR6M...

PT-2026-77235

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server functions.js before invoking...

Linux Distros Unpatched Vulnerability : CVE-2026-74997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted...

MINI-99XW-3WHX-98Q8

Bulletin has no description...

CVE-2026-74945

creationtimestamp| type| source ---|---|--- 2026-08-17 15:43:53+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3mtc26sf6cu2k 2026-08-18 01:00:04+00:00| published-proof-of-concept| Telegram/idIOBRrg4VzKcTwjdY2a29HXXP5ypVWeuPQHuHGKT56HHBs 2026-08-19 00:00:27+00:00|...

CVE-2026-74361

creationtimestamp| type| source ---|---|--- 2026-08-17 14:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtbx6lw5ym2y...

MINI-6XR4-69JF-J5CX

Bulletin has no description...

MINI-HX6X-5HF5-69G6

Bulletin has no description...

MINI-G8G7-VJ9J-GJP3

Bulletin has no description...

CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...

CVE-2026-74997

Roundcube Webmail's markasjunk plugin cmd_learn driver allows RCE via crafted placeholder replacement values in versions before 1.6.18 and 1.7.x before 1.7.3. Fix: upgrade to 1.6.18 or 1.7.3. CVSS 8.8 (HIGH). Exploitation details not provided in documents.

CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...

EUVD-2026-60164

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...

CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...