Vendor/product archive

morgan_project / morgan CVEs

Beta · best-effort

2 CVEs tagged to morgan_project / morgan — 1 Critical, 0 High, 1 Medium, 0 Low, 0 Unrated.

See this archive with more filters Back to morgan_project vendor archive

CVE-2026-5078

Published Jun 3, 2026

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutraliz…

CVSS 5.3 · Medium

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

CVE-2019-5413

Published Mar 21, 2019

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

Showing 1-2 of 2 CVEsPage 1 of 1