VendorsMorgan Projectmorganany version
Vulnerabilities

Morgan Project Morgan any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

3CVEs
CVE-2019-5413
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
Published 2019-03-17 · Modified
9.8EPSS 0.034
CVE-2026-5078
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Published 2026-06-03 · Analyzed
5.3EPSS 0.004
CVE-2026-15603
morgan vulnerable to Log Forging via unescaped Unicode line separators
Published 2026-08-28 · Analyzed
5.3EPSS 0.003