Login Request a demo
GR
Product
graylog2-server
by Graylog2 · last CVE Sep 21, 2026
12
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 0High 3Medium 9Low 0
Severity
All severities12Critical0High3Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add graylog2-server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-53106
8.8
1%
Jul 2
Graylog vulnerable to privilege escalation through API tokens
Affected: >= 6.2.0, < 6.2.4; >= 6.3.0-alpha.1, < 6.3.0-rc.2
CVE-2024-24824
8.8
35%
Feb 7
graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
Affected: >= 2.0.0, < 5.1.11; >= 5.2.0, < 5.2.4
CVE-2026-55841
7.5
1%
Aug 28
Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
Affected: < 6.3.12; >= 7.0.0-alpha.1, < 7.0.7; >= 7.1.0-alpha.1, < 7.1.2
CVE-2026-92789
6.5
0%
Sep 16
Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect
Affected: through 7.1.4
CVE-2024-52506
6.5
1%
Nov 18
Graylog can leak other users' reports via concurrent PDF report rendering
Affected: >= 6.1.0, < 6.1.2
CVE-2026-69190
6.3
0%
Sep 21
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Affected: >= 6.3.0, < 6.3.14; >= 7.0.0, < 7.0.9; >= 7.1.0, < 7.1.4
CVE-2025-46827
5.4
0%
May 7
Graylog Allows Session Takeover via Insufficient HTML Sanitization
Affected: < 6.0.14; >= 6.1.0, < 6.1.10
CVE-2026-55867
5.3
1%
Aug 28
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
Affected: >= 6.2.0, < 6.3.12; >= 7.0.0-alpha.1, < 7.0.7; >= 7.1.0-alpha.1, < 7.1.2
CVE-2025-30373
5.3
0%
Apr 7
Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
Affected: >= 6.1.0, < 6.1.9
CVE-2026-55425
5.0
0%
Aug 28
Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Affected: >= 7.1.0, < 7.1.4; >= 7.2.0-alpha.1, < 7.2.0-alpha.2
CVE-2024-24823
4.4
0%
Feb 7
graylog2-server Session Fixation vulnerability through cookie injection
Affected: >= 4.3.0, < 5.1.11; >= 5.2.0, < 5.2.4
CVE-2026-65011
4.3
0%
Jul 22
Graylog2 Server Missing Permission Check on Event Definition Duplicate
Affected: through 7.1.5; through 7.0.10
Showing 12