CO
Product
countly-server
7
CVEs
0
On KEV
9.0
Max CVSS
4
New 30D
Severity mix
Critical 2High 5Medium 0Low 0
Watch
Add countly-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42269 | 8.1 | Oct 16 | countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion Affected: < 24.05.50; >= 25.03, < 25.03.44 |
| CVE-2022-29174 | 8.1 | May 17 | Predictable password reset token may lead to account takeover in countly-server Affected: < 21.11.4; >= 22.0.0, < 22.03.7 |
| CVE-2026-41582 | 7.5 | Oct 16 | countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files Affected: < 24.05.50; >= 25.03, < 25.03.44 |
| CVE-2026-42270 | 7.5 | Oct 16 | countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception Affected: < 24.05.50; >= 25.03, < 25.03.44 |
| CVE-2026-87803 | 7.1 | Sep 10 | An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer Affected: before 25.03.53-LTS |
Showing 5