StackRadar

CVE-2026-15603

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
85
of 17,781 indexed, latest versions
Container images
84
deployed by those charts
Fix available
1 of 1
affected package

morgan vulnerable to Log Forging via unescaped Unicode line separators

Carried by container images the latest versions of 85 of 17,781 indexed charts deploy, on 84 images.

Affected packageAffected versionsFixed inImages
morgannpm1.6.1, 1.7.0, 1.9.0, 1.9.1+3 more1.12.084
OSV records
GHSA-jxfw-x594-9x9m

Charts affected

85 by stars
ChartLatestAffected imagesRadar Score
mongo-expresscowboysysopVerified publisher7.0.01 of 1See more

mongo-express cowboysysop 7.0.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
library/mongo-express:1.0.21b23d7976f02
morgan@1.10.0
1.12.0

Open the chart page →

1,210
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
morgan@1.10.0
1.12.0

Open the chart page →

7,210
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
morgan@1.11.0
1.12.0

Open the chart page →

2,938
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
morgan@1.10.1
1.12.0

Open the chart page →

30,326
lighthouse-cicowboysysopVerified publisher9.0.01 of 1See more

lighthouse-ci cowboysysop 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
patrickhulce/lhci-server:0.8.174b4b6a3954d
morgan@1.10.0
1.12.0

Open the chart page →

2,213
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
morgan@1.10.0
1.12.0

Open the chart page →

8,213
open5gsopen5gsVerified publisher2.3.41 of 5See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
morgan@1.10.0
1.12.0

Open the chart page →

9,261
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
morgan@1.10.0
1.12.0

Open the chart page →

3,476
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
morgan@1.6.1
1.12.0

Open the chart page →

5,209
kubeviouskubevious1.2.24 of 7See more

kubevious kubevious 1.2.2

4 of the 7 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
morgan@1.10.0
1.12.0
kubevious/collector:1.2.1f58226f9d84e
morgan@1.10.0
1.12.0
kubevious/guard:1.2.19bf567704de2
morgan@1.10.0
1.12.0
kubevious/parser:1.2.299ae7a5168c2
morgan@1.10.0
1.12.0

Open the chart page →

14,204
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
morgan@1.10.0
1.12.0

Open the chart page →

18,517
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
morgan@1.11.0
1.12.0

Open the chart page →

977
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
morgan@1.10.1
1.12.0

Open the chart page →

1,044
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
morgan@1.10.0
1.12.0

Open the chart page →

5,670
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
morgan@1.10.0
1.12.0

Open the chart page →

31,510
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
morgan@1.10.0
1.12.0

Open the chart page →

2,519
lifecycle-jira-integrationlifecycle-jira-integration1.0.01 of 1See more

lifecycle-jira-integration lifecycle-jira-integration 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
anoopnair/lifecycle-jira-integration:latestd80c73a6089d
morgan@1.10.0
1.12.0

Open the chart page →

927
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
morgan@1.10.0
1.12.0

Open the chart page →

5,300
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
morgan@1.10.0
1.12.0

Open the chart page →

6,873
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
morgan@1.10.1
1.12.0

Open the chart page →

7,035
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
morgan@1.9.1
1.12.0

Open the chart page →

31,844
scrapoxywiremindVerified publisher0.3.41 of 1See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
wiremind/scrapoxy:lateste7048929a676
morgan@1.9.1
1.12.0

Open the chart page →

2,154
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
morgan@1.9.0
1.12.0

Open the chart page →

25,443
admin-portaladmin-web-portal1.2.11 of 2See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
soulou2019/node-server:latest5e6ecfcc109e
morgan@1.10.0
1.12.0

Open the chart page →

3,419
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
morgan@1.10.0
1.12.0

Open the chart page →

3,437
trifidappuio2.0.21 of 1See more

trifid appuio 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
zazuko/trifid:2.3.7054be137de70
morgan@1.10.0
1.12.0

Open the chart page →

2,783
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
morgan@1.6.1
1.12.0

Open the chart page →

18,277
http-debugbicarus-labs0.1.01 of 1See more

http-debug bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
bicarus/http-https-echo:2785dd6a7e805e
morgan@1.10.0
1.12.0

Open the chart page →

867
registry-uibryanalves0.2.01 of 1See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
konradkleine/docker-registry-frontend:v2181aad54ee64
morgan@1.6.1
1.12.0

Open the chart page →

4,069
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
morgan@1.10.0
1.12.0
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
morgan@1.10.0
1.12.0
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
morgan@1.10.0
1.12.0

Open the chart page →

18,293
stocksalescluster-deploy0.1.31 of 1See more

stocksales cluster-deploy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
foggbh/stocky:latest8b7a2e5ecf4e
morgan@1.10.1
1.12.0

Open the chart page →

408
cors-proxycors-proxyVerified publisher1.2.01 of 1See more

cors-proxy cors-proxy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
morgan@1.10.1
1.12.0

Open the chart page →

1,598
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
morgan@1.6.1
1.12.0

Open the chart page →

5,209
azuriteemberstackVerified publisher1.0.211 of 1See more

azurite emberstack 1.0.21

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
morgan@1.11.0
1.12.0

Open the chart page →

365
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
morgan@1.10.1
1.12.0

Open the chart page →

1,755
smeejasfanzynoodle0.0.11 of 1See more

smeejas fanzynoodle 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
fanzynoodle/smeejas:0.0.15f9916c1a287
morgan@1.10.0
1.12.0

Open the chart page →

4,127
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
morgan@1.11.0
1.12.0

Open the chart page →

1,847
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
morgan@1.10.0
1.12.0

Open the chart page →

3,159
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
morgan@1.6.1
1.12.0

Open the chart page →

5,941
galoy-paygaloymoney0.11.481 of 2See more

galoy-pay galoymoney 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
morgan@1.10.0
1.12.0

Open the chart page →

2,528
galoy-paygaloymoney20.11.481 of 2See more

galoy-pay galoymoney2 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
morgan@1.10.0
1.12.0

Open the chart page →

2,528
littlelink-servergeek-cookbookVerified publisher1.4.21 of 1See more

littlelink-server geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
morgan@1.10.0
1.12.0

Open the chart page →

819
littlelink-serverh2mVerified publisher1.0.11 of 1See more

littlelink-server h2m 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
morgan@1.10.0
1.12.0

Open the chart page →

819
h2ph2pVerified publisher1.0.11 of 1See more

h2p h2p 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
dacinfomotion/h2p:latest68fa393b472c
morgan@1.10.0
1.12.0

Open the chart page →

1,713
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
morgan@1.10.0
1.12.0

Open the chart page →

3,003
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
morgan@1.9.1
1.12.0

Open the chart page →

24,161
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
morgan@1.9.1
1.12.0
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
morgan@1.9.1
1.12.0
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
morgan@1.9.1
1.12.0
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
morgan@1.9.1
1.12.0

Open the chart page →

89,959
nodeapphelmcharts0.1.41 of 1See more

nodeapp helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
kaushaln1/helm_node_app:lateste9f2d5dfdba0
morgan@1.10.0
1.12.0

Open the chart page →

948
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
morgan@1.10.0
1.12.0

Open the chart page →

8,213
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-15603.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
morgan@1.10.0
1.12.0

Open the chart page →

5,769

Container images carrying it

84 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
svenwal/jsonplaceholder:latestba2f285af432
morgan@1.10.0
1.12.0
1
tensorzero/ui:2026.6.0f2563d54724e
morgan@1.10.1
1.12.0
1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
morgan@1.10.0
1.12.0
1
treskon/portrait-ui:DEV-lateste7970783bc8d
morgan@1.9.1
1.12.0
1
vcnngr/pnbackend:latesteaf44ad0ad1f
morgan@1.10.1
1.12.0
1
wekanteam/wekan:v4.2268a51f0327df
morgan@1.6.1
1.12.0
1
wiremind/scrapoxy:lateste7048929a676
morgan@1.9.1
1.12.0
1
zazuko/trifid:2.3.7054be137de70
morgan@1.10.0
1.12.0
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
morgan@1.10.0
1.12.0
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
morgan@1.10.1
1.12.0
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
morgan@1.10.1
1.12.0
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
morgan@1.9.1
1.12.0
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
morgan@1.9.1
1.12.0
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
morgan@1.9.1
1.12.0
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
morgan@1.9.1
1.12.0
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
morgan@1.10.0
1.12.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
morgan@1.10.0
1.12.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
morgan@1.10.0
1.12.0
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
morgan@1.10.1
1.12.0
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
morgan@1.10.1
1.12.0
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
morgan@1.10.0
1.12.0
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
morgan@1.10.0
1.12.0
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
morgan@1.10.0
1.12.0
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
morgan@1.10.0
1.12.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
morgan@1.10.1
1.12.0
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
morgan@1.10.1
1.12.0
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
morgan@1.10.0
1.12.0
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
morgan@1.11.0
1.12.0
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
morgan@1.9.1
1.12.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
morgan@1.10.1
1.12.0
1
quay.io/wekan/wekan:v5.65cb17600883a3
morgan@1.6.1
1.12.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
morgan@1.11.0
1.12.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
morgan@1.10.0
1.12.0
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
morgan@1.9.0
1.12.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.