Is Graylog 6.1.4 affected?

CVSS 8.0

7 known vulnerabilities affect 6.1.4 (highest CVSS 8.0).

Your branch 6.1 has reached end of life (Oct 20, 2025).

73 newer releases in its track, up to 7.2.1. What changed up to 7.2.1

Vulnerabilities affecting 6.1.4

8.0
CVE-2025-46827 Session Takeover via Insufficient HTML Sanitization
7.5
GHSA-xwgc-q8x5-538w IPFIX input parser can be exploited to consume excessive CPU and block message processing
7.5
CVE-2026-55841 Fortigate syslog message parser can be exploited to modify or delete fields from the original message fixed in 6.3.12
7.3
GHSA-q9q2-3ppx-mwqf Stored Cross-Site Scripting via Files Plugin and API Browser fixed in 6.2.0
7.2
GHSA-w9wq-g358-3x8g Privilege escalation via user creation and user permission/role updates fixed in 7.0.13
6.5
CVE-2025-30373 Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value fixed in 6.1.9
5.3
GHSA-vpqc-v737-94g9 Palo Alto Networks input parser can be exploited to consume excessive CPU and delay message processing