CO
Vendor
Countly
7
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-44977 | CO countly-server Countly | 9.0 | Oct 16 | countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context |
| CVE-2026-41582 | CO countly-server Countly | 7.5 | Oct 16 | countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files |
| CVE-2026-42270 | CO countly-server Countly | 7.5 | Oct 16 | countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception |
| CVE-2026-42269 | CO countly-server Countly | 8.1 | Oct 16 | countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion |
| CVE-2026-87803 | CO countly-server Countly | 7.1 | Sep 10 | An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer |
| CVE-2021-32852 | CO countly-server Countly | 9.0 | Feb 20 | countly-server vulnerable to Cross-site Scripting |
| CVE-2022-29174 | CO countly-server Countly | 8.1 | May 17 | Predictable password reset token may lead to account takeover in countly-server |