Countly countly-server

• CVE-2026-44977 Critical 9.0 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context 0.4%
• CVE-2026-41582 High 7.5 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files 0.5%
• CVE-2026-42270 High 7.5 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception 0.5%
• CVE-2026-42269 High 8.1 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion 0.5%
• CVE-2026-87803 High 7.1 An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controll 0.3%
• CVE-2021-32852 Medium 5.4 countly-server vulnerable to Cross-site Scripting 0.9%
• CVE-2022-29174 High 8.1 Predictable password reset token may lead to account takeover in countly-server 1.5%