Vulnerabilities

TI-2026-75341 CVE-2026-44977

Stored XSS in countly-server feedback upload exposes global admin session

HIGH 74

countly-server is the server-side part of Countly, a product analytics solution.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00436 Published 2026-10-16 Fixed in 24.05.50, 25.03.44 CWE-79

TI-2026-75338 CVE-2026-41582

HIGH 72

countly-server is the server-side part of Countly, a product analytics solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2026-10-16 Fixed in 24.05.50, 25.03.44 CWE-22

TI-2026-75340 CVE-2026-42270

HIGH 72

countly-server is the server-side part of Countly, a product analytics solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00542 Published 2026-10-16 Fixed in 24.05.50, 25.03.44 CWE-248

TI-2026-75339 CVE-2026-42269

LOW 36

countly-server is the server-side part of Countly, a product analytics solution.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00469 Published 2026-10-16 Fixed in 24.05.50, 25.03.44 CWE-22

TI-2026-59922 CVE-2026-87803 · GHSA-3m7r-f729-ggmf

LOW 31

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00308 Published 2026-09-10 Fixed in 25.03.53-LTS CWE-863