CVE-2026-42281: Unauthenticated SSRF in MagicMirror²

I have a Raspberry Pi collection that has slowly taken on a life of its own. Each model has its own project, and I periodically end up on YouTube looking for new ideas. That’s how I came across MagicMirror²: an open-source smart mirror that uses a Raspberry Pi to project a series of interactive dashboards, news, weather, calendar, and public transport schedules onto a two-way mirror monitor. The end result looks great, and the project has an active community of people building custom modules. ...

Pubblicato il 04/05/2026 · 13 min · 2753 words · Astaruf

CVE-2026-41653: Stored XSS > File Exfiltration in BentoPDF

One of the things I keep asking myself when I review source code is: “what is this application’s real attack surface?”. Not in the abstract sense (every application has attack surface), but in the concrete sense: if I get code execution here, what can I actually reach? What data moves through this thing, and where does it go? I found BentoPDF while working on a personal project. I was browsing GitHub looking for interesting open-source tools, stumbled across it, and thought: privacy-first, fully client-side PDF processor, WebAssembly, zero backend. Architecturally unusual. Worth a closer look. ...

Pubblicato il 29/04/2026 · 14 min · 2771 words · Astaruf