{"api_version":"v1","generated_at":"2026-10-07T08:20:00+00:00","product":{"cve_count":5,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-magicmirrororg-magicmirror-cba63f1507aa","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/magicmirror","name":"MagicMirror","next_cursor":null,"observations":[{"affected":"< 2.37.0","affected_versions_present":true,"cve_id":"CVE-2026-63640","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-63640","fixed":"2.37.0.","last_modified":"2026-08-18T17:56:32.044Z","patch_url":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8","primary_source":"","published":"2026-08-18T17:35:44.944Z"},{"affected":"< 2.37.0","affected_versions_present":true,"cve_id":"CVE-2026-63642","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-63642","fixed":"2.37.0.","last_modified":"2026-08-19T15:06:31.454Z","patch_url":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g","primary_source":"","published":"2026-08-18T17:22:02.733Z"},{"affected":"< 2.37.0","affected_versions_present":true,"cve_id":"CVE-2026-63643","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-63643","fixed":"2.37.0.","last_modified":"2026-08-19T18:21:37.126Z","patch_url":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j","primary_source":"","published":"2026-08-18T17:18:52.556Z"},{"affected":"< 2.37.0","affected_versions_present":true,"cve_id":"CVE-2026-63641","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-63641","fixed":"2.37.0.","last_modified":"2026-08-18T19:26:23.631Z","patch_url":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3","primary_source":"","published":"2026-08-18T17:13:03.109Z"},{"affected":"< 2.36.0","affected_versions_present":true,"cve_id":"CVE-2026-42281","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-42281","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-05-14T19:51:14.186Z","patch_url":"","primary_source":"","published":"2026-05-14T15:46:41.076Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"MagicMirrorOrg"}}