- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 15 · 4 high, 5 medium, 3 low
- Dependents
- 4
- Registry
- Maven Central
Advisories 15
- CVE-2026-69190Medium 6.3
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Affected: from 6.3.0, fixed in 6.3.14; from 7.0.0, fixed in 7.0.9; from 7.1.0, fixed in 7.1.4.
- CVE-2026-55867Medium 5.3
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
Affected: from 6.2.0, fixed in 6.3.12; from 7.0.0, fixed in 7.0.7; from 7.1.0, fixed in 7.1.2.
- CVE-2026-55841High 7.5
Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
Affected: fixed in 6.3.12; from 7.0.0, fixed in 7.0.7; from 7.1.0, fixed in 7.1.2.
- CVE-2026-55425Medium 5.0
Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Affected: from 7.1.0, fixed in 7.1.4.
- CVE-2025-53106High 8.8
Graylog vulnerable to privilege escalation through API tokens
Affected: from 6.2.0, fixed in 6.2.4; from 6.3.0-alpha.1, fixed in 6.3.0-rc.2.
- CVE-2025-46827High 8.0
Graylog Allows Session Takeover via Insufficient HTML Sanitization
Affected: fixed in 6.0.14; from 6.1.0, fixed in 6.1.10.
- CVE-2025-30373Medium 6.5
Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
Affected: from 6.1.0, fixed in 6.1.9.
- CVE-2024-24824High 8.8
graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
Affected: from 2.0.0, fixed in 5.1.11; from 5.2.0-alpha.1, fixed in 5.2.4.
- CVE-2024-24823Medium 5.7
graylog2-server Session Fixation vulnerability through cookie injection
Affected: from 4.3.0, fixed in 5.1.11; from 5.2.0-alpha.1, fixed in 5.2.4.
- CVE-2023-41045Low 3.7
Insecure source port usage for DNS queries in Graylog
Affected: from 5.1.0, fixed in 5.1.3; fixed in 5.0.9.
- CVE-2023-41044Low 3.3
Partial path traversal vulnerability in Support Bundle feature of Graylog
Affected: from 5.1.0, fixed in 5.1.3.
- CVE-2023-41041Low 2.6
User session is still usable after logout in graylog2-server
Affected: from 1.0, fixed in 5.0.9; from 5.1.0, fixed in 5.1.3.
- CVE-2018-14380Unrated
In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and…
Affected: fixed in 2.4.6.
- CVE-2018-11651Unrated
Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx…
Affected: fixed in 2.4.4.
- CVE-2018-11650Unrated
Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
Affected: fixed in 2.4.4.