CVE-2026-63641

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

CVE-2026-53984: Missing Authentication for Critical Function

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

io.github.comet-crypto:lib (>=0.2, <=0.2.3), io.socket:socket.io-server (>=3.0.0, <=3.0.1) potentially affected by CVE-2022-25867 via io.socket:socket.io-client (2.0.0)

io.socket:socket.io-client MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.socket:socket.io-client and may be impacted: - io.github.comet-crypto:lib =0.2, =3.0.0, =3.0.1 Source cves: CVE-2022-25867 Source advisory:...