383 matches found
Security Bulletin: The Use Case Manager App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Use Case Manager App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-87776 DESCRIPTION: compression is...
CVE-2026-111877
A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit ha...
CVE-2026-111877 dext34-morgan Books4Cash search.php cross site scripting
A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit ha...
CVE-2026-111877
The dext34-morgan Books4Cash application (up to commit a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571 ) is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in an unspecified part of the search.php file, where a remote attacker can manipulate the Search argument to execute malicious scripts. T...
EUVD-2026-103388
A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit ha...
CVE-2026-111877: Improper Neutralization of Input During Web Page Generation
A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit ha...
Security Bulletin:morgan HTTP Request Logger Middleware: Unicode Line Separator Log Forge Vulnerability
Summary morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remo...
Security Bulletin: : IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the...
CLSA-2026-1790676372 TuxCare security update for morgan (1 CVE)
TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.4...
CLSA-2026-1790673247 TuxCare security update for morgan (1 CVE)
TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.6.1-tuxcare.4...
NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields vulnerability discovered by ? in WordPress Npm morgan versions 1.12.1...
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...
20231122-npm (1.0.0), 2048.io (0.0.1) +6538 more potentially affected by CVE-2026-87859 via morgan (>=1.0.0, <=1.12.0)
morgan NPM version =1.0.0, =1.0.2, =1.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.3 and more Source cves: CVE-2026-87859 Source advisory: GHSA-9F6G-J8CH-79G4...
20231122-npm (1.0.0), 2048.io (0.0.1) +6538 more potentially affected by CVE-2026-87859 via morgan (>=1.0.0, <=1.12.0)
morgan NPM version =1.0.0, =1.0.2, =1.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.3 and more Source cves: CVE-2026-87859 Source advisory: OSV:GHSA-9F6G-J8CH-79G4...
GHSA-9F6G-J8CH-79G4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...
EUVD-2026-76027
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields...
CLSA-2026-1790108609 TuxCare security update for morgan (1 CVE)
TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.3...
PT-2026-105362
TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.3...
Malicious Package
Overview lint-aquarius-morgan-ora is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
SUSE CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...