CVE-2026-1441 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1440 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1439 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1438 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1437 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1436 | Medium | 6.5 | 2026-02-18 | Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other us… |
CVE-2026-1435 | Critical | 9.8 | 2026-02-18 | Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. T… |
CVE-2025-53106 | High | 8.8 | 2025-07-02 | Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated p… |
CVE-2025-46827 | High | 8.0 | 2025-05-07 | Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an… |
CVE-2025-30373 | Medium | 6.5 | 2025-04-07 | Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specif… |
CVE-2024-52506 | Medium | 6.5 | 2024-11-18 | Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboar… |
CVE-2024-24824 | High | 8.8 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and insta… |
CVE-2024-24823 | Medium | 5.7 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session… |
CVE-2023-41045 | Low | 3.7 | 2023-08-31 | Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoin… |
CVE-2023-41044 | Low | 3.3 | 2023-08-31 | Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is c… |
CVE-2023-41041 | Low | 2.6 | 2023-08-30 | Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used f… |
CVE-2021-37760 | Critical | 9.8 | 2021-07-31 | A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). |
CVE-2021-37759 | Critical | 9.8 | 2021-07-31 | A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). |
CVE-2020-15813 | High | 8.1 | 2020-07-17 | Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configu… |
CVE-2018-14380 | Medium | 6.1 | 2018-07-18 | In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts. |
CVE-2018-11651 | Medium | 6.1 | 2018-06-01 | Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/Edi… |
CVE-2018-11650 | Medium | 6.1 | 2018-06-01 | Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js. |