Advisoriesby IbisGraylog security advisories
16 advisories across Graylog
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboardsCVE-2026-69190fixed in 6.3.14 +2Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensCVE-2026-55867fixed in 6.3.12 +2Fortigate syslog message parser can be exploited to modify or delete fields from the original messageCVE-2026-55841fixed in 6.3.12 +2Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fieldsCVE-2026-55425fixed in 7.1.4Graylog vulnerable to privilege escalation through API tokensCVE-2025-53106fixed in 6.2.4 +1Graylog Allows Session Takeover via Insufficient HTML SanitizationCVE-2025-46827fixed in 6.0.14 +1Graylog Allows Stored Cross-Site Scripting via Files Plugin and API BrowserGHSA-q9q2-3ppx-mwqffixed in 6.2.0Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong valueCVE-2025-30373fixed in 6.1.9Graylog session fixation vulnerability through cookie injectionCVE-2024-24823fixed in 5.1.11 +1Graylog vulnerable to instantiation of arbitrary classes triggered by API requestCVE-2024-24824fixed in 5.1.11 +1Graylog server has partial path traversal vulnerability in Support Bundle featureCVE-2023-41044fixed in 5.1.3Graylog vulnerable to insecure source port usage for DNS queriesCVE-2023-41045fixed in 5.0.9 +1Graylog user session is still usable after logoutCVE-2023-41041fixed in 5.0.9 +1Cross-site Scripting in GraylogCVE-2018-11651fixed in 2.4.4Cross-site Scripting in Graylog ServerCVE-2018-11650fixed in 2.4.4Cross-site Scripting in Graylog ServerCVE-2018-14380fixed in 2.4.6