GR
Product
Graylog
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 14Low 2
Watch
Add Graylog to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1435 | 9.8 | Feb 18 | Incorrect management of session invalidation vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2021-37760 | 9.8 | Jul 31 | A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID) Affected: 2.1.1 before 4.1.2 |
| CVE-2021-37759 | 9.8 | Jul 31 | A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID) Affected: 0.20.0 before 4.1.2 |
| CVE-2025-53106 | 8.8 | Jul 2 | Graylog vulnerable to privilege escalation through API tokens Affected: 6.2.0 before 6.2.4; 6.3.0; 6.3.0; 6.3.0; 6.3.0; 6.3.0; +6 more |
| CVE-2024-24824 | 8.8 | Feb 7 | graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request Affected: 2.0.0 before 5.1.11; 5.2.0 before 5.2.4 |
| CVE-2020-15813 | 8.1 | Jul 17 | Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers Affected: before 3.3.3 |
| CVE-2026-1436 | 6.5 | Feb 18 | Improper Access Control (IDOR) vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2024-52506 | 6.5 | Nov 18 | Graylog can leak other users' reports via concurrent PDF report rendering Affected: 6.1.0 before 6.1.2 |
| CVE-2026-1441 | 6.1 | Feb 18 | Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2026-1440 | 6.1 | Feb 18 | Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2026-1439 | 6.1 | Feb 18 | Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2026-1438 | 6.1 | Feb 18 | Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2026-1437 | 6.1 | Feb 18 | Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface Affected: 2.2.3 |
| CVE-2018-14380 | 6.1 | Jul 18 | In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts Affected: before 2.4.6 |
| CVE-2018-11651 | 6.1 | Jun 1 | Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx,… Affected: before 2.4.4 |
| CVE-2018-11650 | 6.1 | Jun 1 | Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js Affected: before 2.4.4 |
| CVE-2025-46827 | 5.4 | May 7 | Graylog Allows Session Takeover via Insufficient HTML Sanitization Affected: before 6.0.14; 6.1.0 before 6.1.10 |
| CVE-2025-30373 | 5.3 | Apr 7 | Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value Affected: 6.1.0 before 6.1.9 |
| CVE-2023-41045 | 5.3 | Aug 31 | Graylog is a free and open log management platform Affected: before 5.0.9; 5.1.0 before 5.1.3 |
| CVE-2024-24823 | 4.4 | Feb 7 | graylog2-server Session Fixation vulnerability through cookie injection Affected: 4.3.0 before 5.1.11; 5.2.0 before 5.2.4 |
| CVE-2023-41044 | 3.8 | Aug 31 | Graylog is a free and open log management platform Affected: 5.1.0 before 5.1.3 |
| CVE-2023-41041 | 3.1 | Aug 30 | Graylog is a free and open log management platform Affected: 1.0.0 before 5.0.9; 5.1.0 before 5.1.3 |
Showing 22