org.graylog.plugins:graylog-plugin-parent (4.2.10), org.graylog.plugins:graylog-plugin-web-parent (4.2.10) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (4.2.10)

org.graylog2:graylog2-server MAVEN version 4.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.2.10 - org.graylog.plugins:graylog-plugin-web-parent 4.2.1...

org.graylog.plugins:graylog-plugin-parent (5.2.3), org.graylog.plugins:graylog-plugin-web-parent (5.2.3) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (5.2.3)

org.graylog2:graylog2-server MAVEN version 5.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 5.2.3 - org.graylog.plugins:graylog-plugin-web-parent 5.2.3...

org.graylog.plugins:graylog-plugin-parent (4.2.9), org.graylog.plugins:graylog-plugin-web-parent (4.2.9) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (4.2.9)

org.graylog2:graylog2-server MAVEN version 4.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.2.9 - org.graylog.plugins:graylog-plugin-web-parent 4.2.9...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=6.0.0, <=6.3.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (>=6.0.0, <=6.3.0) +3 more potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (>=6.0.0, <=6.3.11)

org.graylog2:graylog2-server MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.3.11 Source cves: CVE-2026-55841 Source advisory: GHSA-GQR6-R77P-C2PJ...

org.graylog.plugins:usage-statistics (2.0.0-alpha.4) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (2.0.0-alpha.4)

org.graylog2:graylog2-server MAVEN version 2.0.0-alpha.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:usage-statistics 2.0.0-alpha.4 Source cves: CVE-2026-55841 Source advisory:...

org.graylog.plugins:graylog-plugin-parent (3.3.5), org.graylog.plugins:graylog-plugin-web-parent (3.3.5) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (3.3.5)

org.graylog2:graylog2-server MAVEN version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.3.5 - org.graylog.plugins:graylog-plugin-web-parent 3.3.5...

org.graylog.plugins:graylog-plugin-parent (4.0.8), org.graylog.plugins:graylog-plugin-web-parent (4.0.8) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (4.0.8)

org.graylog2:graylog2-server MAVEN version 4.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.0.8 - org.graylog.plugins:graylog-plugin-web-parent 4.0.8...

Improper Neutralization of Special Elements

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in its syslog key-value message parser, which handles the key-value format emitted by Fortigate devices. An attacker can overwrite...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.1.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=1.0.0, <=6.3.0) +12 more potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (>=1.0.0-beta.3, <=6.3.11)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.0.3, =1.0.0-beta.2, =1.2.0-rc.1, =1.3.4 Source cves: CVE-2026-55841 Source advisory: MEND:CVE-2026-55841...

org.graylog.plugins:graylog-plugin-parent (7.1.1), org.graylog.plugins:graylog-plugin-web-parent (7.1.1) potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (7.1.1)

org.graylog2:graylog2-server MAVEN version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 7.1.1 - org.graylog.plugins:graylog-plugin-web-parent 7.1.1...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.6)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.6 Source cves: CVE-2026-55841 Source advisory: MEND:CVE-2026-55841...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-55425 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-55425 Source advisory: OSV:GHSA-Q79R-R9XG-R863...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-55425 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-55425 Source advisory: GHSA-Q79R-R9XG-R863...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-55425 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-55425 Source advisory: SNYK:JAVA-ORGGRAYLOG2-19433286...

Information Exposure

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Information Exposure in the system catalog entity titles API endpoint, which returns requested database fields without filtering out ones marked protected. A user with a standar...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-55425 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-55425 Source advisory: MEND:CVE-2026-55425...

com.automationrockstars:gunter-rabbit (>=1.0.2, <=2.0.3), com.rabbitmq.jms:rabbitmq-jms (1.4.7) +4 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.6.2)

com.rabbitmq:amqp-client MAVEN version 3.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.automationrockstars:gunter-rabbit =1.0.2, =1.1.1, =3.3.0.cr1, =3.3.0.cr1, =2.1.0-alpha.1, =2.1.0-alpha.2...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-65011 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.10)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.10 Source cves: CVE-2026-65011 Source advisory: SNYK:JAVA-ORGGRAYLOG2-18235361...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.1.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (>=7.1.0, <=7.1.1) +3 more potentially affected by CVE-2026-65011 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.5)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.0, =7.1.0, =7.1.1, =7.1.1, =7.1.5 Source cves: CVE-2026-65011 Source advisory: SNYK:JAVA-ORGGRAYLOG2-18235361...

CVE-2026-65011

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...