GGraylog2

Products

Exploited and recent CVEs

• CVE-2026-69190 Medium 6.3 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards 0.4%
• CVE-2026-92789 Medium 6.5 Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect 0.4%
• CVE-2026-55867 Medium 5.3 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens 0.6%
• CVE-2026-55841 High 7.5 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message 0.6%
• CVE-2026-55425 Medium 5.0 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields 0.4%
• CVE-2026-65011 Medium 4.3 Graylog2 Server Missing Permission Check on Event Definition Duplicate 0.4%
• CVE-2025-53106 High 8.8 Graylog vulnerable to privilege escalation through API tokens 0.6%
• CVE-2025-46827 High 8.0 Graylog Allows Session Takeover via Insufficient HTML Sanitization 0.3%
• CVE-2025-30373 Medium 6.5 Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value 0.3%
• CVE-2024-52506 High 7.1 Graylog can leak other users' reports via concurrent PDF report rendering 0.6%
• CVE-2024-24824 High 8.8 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request 34.7%
• CVE-2024-24823 Medium 5.7 graylog2-server Session Fixation vulnerability through cookie injection 0.4%
• CVE-2023-41045 Low 3.7 Insecure source port usage for DNS queries in Graylog 0.4%
• CVE-2023-41044 Low 3.3 Partial path traversal vulnerability in Support Bundle feature of Graylog 0.7%
• CVE-2023-41041 Low 2.6 User session is still usable after logout in graylog2-server 0.5%