CVE-2026-92789 is a high-severity server-side request forgery (SSRF) vulnerability in Graylog through version 7.1.4. The vulnerability allows an attacker with lookup table or event notification permissions to craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses. This could lead to unauthorized access to internal services and potential d [truncated]
CVE-2026-65011 is a vulnerability in Graylog2 Server before commit 46a2eeb. The vulnerability is due to a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint. This allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggr [truncated]
