Skip to content
Noroxi

Graylog records

22 published records for vendor graylog.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
59.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 21
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

22 records
  • CVE-2024-24824
    45Plan

    graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

    HighCVSS 8.8Proof of conceptEPSS 35%

    graylog · graylogFeb 7, 2024

  • CVE-2021-37759
    39Monitor

    A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked s

    CriticalCVSS 9.8No exploitEPSS 1%

    graylog · graylogJul 31, 2021

  • CVE-2021-37760
    39Monitor

    A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked sessio

    CriticalCVSS 9.8No exploitEPSS 1%

    graylog · graylogJul 31, 2021

  • CVE-2026-1435
    37Monitor

    Incorrect management of session invalidation vulnerability in Graylog Web Interface

    CriticalCVSS 9.3No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2025-53106
    35Monitor

    Graylog vulnerable to privilege escalation through API tokens

    HighCVSS 8.8No exploitEPSS 1%

    graylog · graylogJul 2, 2025

  • CVE-2020-15813
    32Monitor

    Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers.

    HighCVSS 8.1No exploitEPSS 1%

    graylog · graylogJul 17, 2020

  • CVE-2024-52506
    28Monitor

    Graylog can leak other users' reports via concurrent PDF report rendering

    HighCVSS 7.1No exploitEPSS 1%

    graylog · graylogNov 18, 2024

  • CVE-2026-1436
    28Monitor

    Improper Access Control (IDOR) vulnerability in Graylog Web Interface

    HighCVSS 7.1No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2018-14380
    24Monitor

    In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/Que

    MediumCVSS 6.1No exploitEPSS 1%

    graylog · graylogJul 18, 2018

  • CVE-2018-11650
    24Monitor

    Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

    MediumCVSS 6.1No exploitEPSS 1%

    graylog · graylogJun 1, 2018

  • CVE-2018-11651
    24Monitor

    Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, compo

    MediumCVSS 6.1No exploitEPSS 1%

    graylog · graylogJun 1, 2018

  • CVE-2023-41045
    21Monitor

    Insecure source port usage for DNS queries in Graylog

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogAug 31, 2023

  • CVE-2025-30373
    21Monitor

    Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogApr 7, 2025

  • CVE-2025-46827
    21Monitor

    Graylog Allows Session Takeover via Insufficient HTML Sanitization

    MediumCVSS 5.4No exploitEPSS 0%

    graylog · graylogMay 7, 2025

  • CVE-2026-1437
    21Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2026-1441
    21Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2026-1440
    21Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2026-1438
    21Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2026-1439
    21Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    MediumCVSS 5.3No exploitEPSS 0%

    graylog · graylogFeb 18, 2026

  • CVE-2024-24823
    17Monitor

    graylog2-server Session Fixation vulnerability through cookie injection

    MediumCVSS 4.4No exploitEPSS 0%

    graylog · graylogFeb 7, 2024

  • CVE-2023-41044
    15Monitor

    Partial path traversal vulnerability in Support Bundle feature of Graylog

    LowCVSS 3.8Proof of conceptEPSS 1%

    graylog · graylogAug 31, 2023

  • CVE-2023-41041
    12Monitor

    User session is still usable after logout in graylog2-server

    LowCVSS 3.1No exploitEPSS 0%

    graylog · graylogAug 30, 2023