CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

PT-2026-63614

The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens...