Graylog2 Graylog2-server vulnerabilities

• graylog2 graylog2-server Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards CVE-2026-69190 Fix available 6.3 MediumSeptember 21, 2026
• graylog2 graylog2-server Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect CVE-2026-92789 7.1 HighSeptember 16, 2026
• graylog2 graylog2-server Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens CVE-2026-55867 Fix available 5.3 MediumAugust 28, 2026
• graylog2 graylog2-server Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message CVE-2026-55841 Fix available 7.5 HighAugust 28, 2026
• graylog2 graylog2-server Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields CVE-2026-55425 Fix available 5.0 MediumAugust 28, 2026
• graylog2 graylog2-server Graylog2 Server Missing Permission Check on Event Definition Duplicate CVE-2026-65011 5.3 MediumJuly 22, 2026
• graylog, graylog2 graylog2-server +1 more Graylog vulnerable to privilege escalation through API tokens CVE-2025-53106 Fix available 8.8 HighJune 30, 2025
• graylog, graylog2 graylog2-server +1 more Graylog Allows Session Takeover via Insufficient HTML Sanitization CVE-2025-46827 Fix available 8.0 HighMay 7, 2025
• graylog, graylog2 graylog2-server +1 more Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value CVE-2025-30373 Fix available 6.5 MediumApril 7, 2025
• graylog, graylog2 graylog2-server +1 more Graylog can leak other users' reports via concurrent PDF report rendering CVE-2024-52506 Fix available 7.1 HighNovember 18, 2024
• graylog, graylog2 graylog2-server +1 more graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVE-2024-24824 Public exploitFix available EPSS 34.7% 8.8 HighFebruary 7, 2024
• graylog, graylog2 graylog2-server +1 more graylog2-server Session Fixation vulnerability through cookie injection CVE-2024-24823 Fix available 5.7 MediumFebruary 7, 2024
• graylog, graylog2 graylog2-server +1 more Partial path traversal vulnerability in Support Bundle feature of Graylog CVE-2023-41044 Public exploitFix available 3.3 LowJuly 6, 2023
• graylog, graylog2 graylog2-server +1 more Insecure source port usage for DNS queries in Graylog CVE-2023-41045 Fix available 3.7 LowJuly 6, 2023
• graylog, graylog2 graylog2-server +1 more User session is still usable after logout in graylog2-server CVE-2023-41041 Fix available 2.6 LowJuly 6, 2023