Countly has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-44977Critical· 9.0countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context62CVE-2026-42270High· 7.5countly-server is the server-side part of Countly, a product analytics solution53CVE-2026-41582High· 7.5countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files53CVE-2026-42269High· 8.1countly-server is the server-side part of Countly, a product analytics solution45CVE-2026-87803High· 7.1An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer39
Countly vulnerabilities
CVEs affecting Countly, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-42269High· 8.1countly-server is the server-side part of Countly, a product analytics solution
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to …
CVE-2026-42270High· 7.5PoCcountly-server is the server-side part of Countly, a product analytics solution
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs stora…
CVE-2026-44977Critical· 9.0PoCcountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-con…
CVE-2026-41582High· 7.5PoCcountly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/…
CVE-2026-87803High· 7.1An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it thr…