Improper Output Neutralization for Logs

Overview org.webjars.npm:morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in its format-token expansion, which does not neutralize the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, and...

20231122-npm (1.0.0), 2048.io (0.0.1) +6526 more potentially affected by CVE-2026-15603 +1 more via morgan (>=1.0.0, <=1.11.0)

morgan NPM version =1.0.0, =1.0.2, =1.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.67 and more Source cves: CVE-2026-15603, CVE-2026-5078 Source advisory: SNYK:JS-MORGAN-19432128...

CVE-2026-5078 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, azurite, tileserver-gl, wazuh-dashboard, wazuh-dashboard-fips...

20231122-npm (1.0.0), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +5990 more potentially affected by CVE-2026-5078 via morgan (>=1.2.0, <=1.10.1)

morgan NPM version =1.2.0, =1.0.2, =1.0.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =12.2.2 and more Source cves: CVE-2026-5078 Source advisory: OSV:GHSA-4VJ7-5MJ6-JM8M...

Linux Distros Unpatched Vulnerability : CVE-2026-5078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log strea...

20231122-npm (1.0.0), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +5990 more potentially affected by CVE-2026-5078 via morgan (>=1.2.0, <=1.10.1)

morgan NPM version =1.2.0, =1.0.2, =1.0.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =12.2.2 and more Source cves: CVE-2026-5078 Source advisory: SNYK:JS-MORGAN-17135841...

20231122-npm (1.0.0), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +5990 more potentially affected by CVE-2026-5078 via morgan (>=1.2.0, <=1.10.1)

morgan NPM version =1.2.0, =1.0.2, =1.0.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =12.2.2 and more Source cves: CVE-2026-5078 Source advisory: MEND:CVE-2026-5078...

CVE-2026-5078

creationtimestamp| type| source ---|---|--- 2026-06-02 19:47:16+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mndedxkb3s2m 2026-06-03 10:39:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnew7lag7b2u 2026-07-10 15:11:59+00:00| seen|...

CVE-2025-5078

creationtimestamp| type| source ---|---|--- 2025-05-22 14:44:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17296 2025-05-22 16:07:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lprirjnajb2q...

CVE-2025-5078 PHPGurukul/Campcodes Online Shopping Portal subcategory.php sql injection

A vulnerability was detected in PHPGurukul/Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/subcategory.php. Performing manipulation of the argument Category results in sql injection. The attack is possible to be carried out remotely. The exploit is now...

CVE-2025-5078 PHPGurukul/Campcodes Online Shopping Portal subcategory.php sql injection

A vulnerability was detected in PHPGurukul/Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/subcategory.php. Performing manipulation of the argument Category results in sql injection. The attack is possible to be carried out remotely. The exploit is now...

CVE-2019-5078

An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.0713 and 03.00.3912, and WAGO PFC100 Firmware version 03.00.3912. A specially crafted set of packets can cause a denial of service, resulting in the devic...

CVE-2018-5078

Online Ticket Booking has XSS via the admin/eventlist.php cast parameter...

CVE-2019-5078

creationtimestamp| type| source ---|---|--- 2024-03-15 19:26:16+00:00| seen| https://t.me/ctinow/209058...

CVE-2023-5078

CVE-2023-5078 concerns Lenovo ThinkPad BIOS where a physical or local attacker with elevated privileges could tamper with BIOS firmware. Affected component: ThinkPad BIOS firmware. Root cause and exact impact are described as limited to tampering with BIOS firmware, with high confidentiality/inte...

MSC-2022-5078

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

Debian: Security Advisory (DSA-5078-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5078-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5078-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM : Squashfs-Tools vulnerabilities (USN-5078-2)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5078-2 advisory. USN-5078-1 fixed several vulnerabilities in Squashfs-Tools. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the...