Is Graylog 5.0.7 affected?

CVSS 8.0

9 known vulnerabilities affect 5.0.7 (highest CVSS 8.0).

Your branch 5.0 has reached end of life (Dec 6, 2023).

126 newer releases in its track, up to 7.2.1. What changed up to 7.2.1

Vulnerabilities affecting 5.0.7

8.0
CVE-2025-46827 Session Takeover via Insufficient HTML Sanitization
7.5
GHSA-xwgc-q8x5-538w IPFIX input parser can be exploited to consume excessive CPU and block message processing
7.5
CVE-2026-55841 Fortigate syslog message parser can be exploited to modify or delete fields from the original message fixed in 6.3.12
7.3
GHSA-q9q2-3ppx-mwqf Stored Cross-Site Scripting via Files Plugin and API Browser fixed in 6.2.0
7.2
GHSA-w9wq-g358-3x8g Privilege escalation via user creation and user permission/role updates fixed in 7.0.13
5.7
CVE-2024-24823 Session fixation vulnerability through cookie injection fixed in 5.1.11
5.3
GHSA-vpqc-v737-94g9 Palo Alto Networks input parser can be exploited to consume excessive CPU and delay message processing
high
CVE-2024-24824 Instantiation of arbitrary classes triggered by API request fixed in 5.1.11
medium
CVE-2023-41045 Insecure source port usage for DNS queries fixed in 5.0.9