Login Request a demo
GR
Product
Graylog
by Graylog · last CVE Feb 18, 2026
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities22In the news0Timeline
Severity mix
Critical 3High 3Medium 14Low 2
Severity
All severities22Critical3High3Medium14Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Graylog to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-1436
6.5
0%
Feb 18
Improper Access Control (IDOR) vulnerability in Graylog Web Interface
Affected: 2.2.3
CVE-2024-52506
6.5
1%
Nov 18
Graylog can leak other users' reports via concurrent PDF report rendering
Affected: 6.1.0 before 6.1.2
CVE-2026-1441
6.1
0%
Feb 18
Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
Affected: 2.2.3
CVE-2026-1440
6.1
0%
Feb 18
Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
Affected: 2.2.3
CVE-2026-1439
6.1
0%
Feb 18
Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
Affected: 2.2.3
CVE-2026-1438
6.1
0%
Feb 18
Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
Affected: 2.2.3
CVE-2026-1437
6.1
0%
Feb 18
Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
Affected: 2.2.3
CVE-2018-14380
6.1
1%
Jul 18
In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts
Affected: before 2.4.6
CVE-2018-11651
6.1
1%
Jun 1
Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx,…
Affected: before 2.4.4
CVE-2018-11650
6.1
1%
Jun 1
Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js
Affected: before 2.4.4
CVE-2025-46827
5.4
0%
May 7
Graylog Allows Session Takeover via Insufficient HTML Sanitization
Affected: before 6.0.14; 6.1.0 before 6.1.10
CVE-2025-30373
5.3
0%
Apr 7
Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
Affected: 6.1.0 before 6.1.9
CVE-2023-41045
5.3
0%
Aug 31
Insecure source port usage for DNS queries in Graylog
Affected: before 5.0.9; 5.1.0 before 5.1.3
CVE-2024-24823
4.4
0%
Feb 7
graylog2-server Session Fixation vulnerability through cookie injection
Affected: 4.3.0 before 5.1.11; 5.2.0 before 5.2.4
Showing 14