Countly countly-server vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20265

Newest CVEs

• CVE-2026-44977

  countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

  Countly · countly-server

  Critical9.0
• CVE-2026-41582

  countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

  Countly · countly-server

  High7.5
• CVE-2026-42270

  countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

  Countly · countly-server

  High7.5
• CVE-2026-42269

  countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

  Countly · countly-server

  High8.1
• CVE-2026-87803

  An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db…

  Countly · countly-server

  High7.1
• CVE-2021-32852

  countly-server vulnerable to Cross-site Scripting

  Countly · countly-server

  Medium5.4
• CVE-2022-29174

  Predictable password reset token may lead to account takeover in countly-server

  Countly · countly-server

  High8.1