Graylog - vulnerabilities (CVEs)
22 CVEs in 2 products, 0 in the last 30 days, newest from 2026-02-18.
Products
- Graylog - 22 CVEs
- Graylog Web Interface - 7 CVEs
Newest CVEs of Graylog
- CVE-2026-1441 - CVSS 6.1 (medium), 2026-02-18: Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping…
- CVE-2026-1440 - CVSS 6.1 (medium), 2026-02-18: Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping…
- CVE-2026-1439 - CVSS 6.1 (medium), 2026-02-18: Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping…
- CVE-2026-1438 - CVSS 6.1 (medium), 2026-02-18: Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping…
- CVE-2026-1437 - CVSS 6.1 (medium), 2026-02-18: Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping…
- CVE-2026-1436 - CVSS 7.1 (high), 2026-02-18: Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other…
- CVE-2026-1435 - CVSS 9.8 (critical), 2026-02-18: Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins.…
- CVE-2025-53106 - CVSS 8.8 (high), 2025-07-02: Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated…
- CVE-2025-46827 - CVSS 8 (high), 2025-05-07: Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting…
- CVE-2025-30373 - CVSS 6.5 (medium), 2025-04-07: Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a…
- CVE-2024-52506 - CVSS 7.1 (high), 2024-11-18: Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain…
- CVE-2024-24824 - CVSS 8.8 (high), 2024-02-07: Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and…
- CVE-2024-24823 - CVSS 5.7 (medium), 2024-02-07: Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing…
- CVE-2023-41045 - CVSS 5.3 (medium), 2023-08-31: Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for…
- CVE-2023-41044 - CVSS 3.8 (low), 2023-08-31: Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is…
- CVE-2023-41041 - CVSS 3.1 (low), 2023-08-30: Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used…
- CVE-2021-37760 - CVSS 9.8 (critical), 2021-07-31: A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
- CVE-2021-37759 - CVSS 9.8 (critical), 2021-07-31: A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
- CVE-2020-15813 - CVSS 8.1 (high), 2020-07-17: Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection…
- CVE-2018-14380 - CVSS 6.1 (medium), 2018-07-18: In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.
- CVE-2018-11651 - CVSS 6.1 (medium), 2018-06-01: Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx,…
- CVE-2018-11650 - CVSS 6.1 (medium), 2018-06-01: Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
