Graylog vulnerabilities

Products

• Graylog 22
• Web Interface 7

Newest

• graylog, graylog web interface +1 more Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface CVE-2026-1441 5.3 MediumFebruary 18, 2026
• graylog, graylog web interface +1 more Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface CVE-2026-1440 5.3 MediumFebruary 18, 2026
• graylog, graylog web interface +1 more Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface CVE-2026-1439 5.3 MediumFebruary 18, 2026
• graylog, graylog web interface +1 more Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface CVE-2026-1438 5.3 MediumFebruary 18, 2026
• graylog, graylog web interface +1 more Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface CVE-2026-1437 5.3 MediumFebruary 18, 2026
• graylog, graylog web interface +1 more Improper Access Control (IDOR) vulnerability in Graylog Web Interface CVE-2026-1436 7.1 HighFebruary 18, 2026
• graylog, graylog web interface +1 more Incorrect management of session invalidation vulnerability in Graylog Web Interface CVE-2026-1435 9.3 CriticalFebruary 18, 2026
• graylog, graylog2 graylog2-server +1 more Graylog vulnerable to privilege escalation through API tokens CVE-2025-53106 Fix available 8.8 HighJune 30, 2025
• graylog, graylog2 graylog2-server +1 more Graylog Allows Session Takeover via Insufficient HTML Sanitization CVE-2025-46827 Fix available 8.0 HighMay 7, 2025
• graylog, graylog2 graylog2-server +1 more Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value CVE-2025-30373 Fix available 6.5 MediumApril 7, 2025
• graylog, graylog2 graylog2-server +1 more Graylog can leak other users' reports via concurrent PDF report rendering CVE-2024-52506 Fix available 7.1 HighNovember 18, 2024
• graylog, graylog2 graylog2-server +1 more graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVE-2024-24824 Public exploitFix available EPSS 34.7% 8.8 HighFebruary 7, 2024
• graylog, graylog2 graylog2-server +1 more graylog2-server Session Fixation vulnerability through cookie injection CVE-2024-24823 Fix available 5.7 MediumFebruary 7, 2024
• graylog, graylog2 graylog2-server +1 more Partial path traversal vulnerability in Support Bundle feature of Graylog CVE-2023-41044 Public exploitFix available 3.3 LowJuly 6, 2023
• graylog, graylog2 graylog2-server +1 more Insecure source port usage for DNS queries in Graylog CVE-2023-41045 Fix available 3.7 LowJuly 6, 2023
• graylog, graylog2 graylog2-server +1 more User session is still usable after logout in graylog2-server CVE-2023-41041 Fix available 2.6 LowJuly 6, 2023
• graylog A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate... CVE-2021-37759 9.8 CriticalJuly 31, 2021
• graylog A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate... CVE-2021-37760 9.8 CriticalJuly 31, 2021
• graylog Improper Certificate Validation in Graylog CVE-2020-15813 Fix available 8.1 HighJuly 17, 2020
• graylog Cross-site Scripting in Graylog Server CVE-2018-14380 Fix available 6.1 MediumJuly 18, 2018
• graylog Cross-site Scripting in Graylog CVE-2018-11651 Fix available 6.1 MediumJune 1, 2018
• graylog Cross-site Scripting in Graylog Server CVE-2018-11650 Fix available 6.1 MediumJune 1, 2018