Skip to content
OpenAdvisories

Package · Maven

org.graylog2:graylog2-server

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-69190

    Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

    Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner p…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 5.3
    CVE-2026-55867

    Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

    Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 5.0
    CVE-2026-55425

    Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

    Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows …

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 6.5
    CVE-2025-30373

    Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

    Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing hea…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 5.7
    CVE-2024-24823

    graylog2-server Session Fixation vulnerability through cookie injection

    Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 6.1
    CVE-2018-14380

    Cross-site Scripting in Graylog Server

    In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

    org.graylog2:graylog2-server Maven
  • Medium 6.1
    CVE-2018-11651

    Cross-site Scripting in Graylog

    Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

    org.graylog2:graylog2-server Maven
  • Medium 6.1
    CVE-2018-11650

    Cross-site Scripting in Graylog Server

    Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

    org.graylog2:graylog2-server Maven