Parse-community Parse-server vulnerabilities

• parse-community parse-server Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response CVE-2026-120310 2.3 LowNovember 2, 2026
• parse-community parse-server Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID CVE-2026-119571 6.3 MediumOctober 30, 2026
• parse-community parse-server Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses CVE-2026-119570 2.3 LowOctober 30, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service CVE-2026-119569 6.0 MediumOctober 30, 2026
• parse-community parse-server Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys CVE-2026-119126 2.3 LowOctober 29, 2026
• parse-community parse-server Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields CVE-2026-119125 2.3 LowOctober 29, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query CVE-2026-116801 5.3 MediumOctober 26, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB CVE-2026-116165 Fix available 8.8 HighOctober 25, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes CVE-2026-116164 Fix available 6.3 MediumOctober 25, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses CVE-2026-116163 Fix available 9.1 CriticalOctober 25, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login CVE-2026-116162 Fix available 2.1 LowOctober 25, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions CVE-2026-116161 Fix available 6.0 MediumOctober 25, 2026
• parse-community parse-server Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass CVE-2026-112769 Fix available 2.3 LowOctober 19, 2026
• parse-community parse-server Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update CVE-2026-112768 Fix available 6.9 MediumOctober 19, 2026
• parse-community parse-server Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error CVE-2026-110854 Fix available 8.2 HighOctober 14, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference CVE-2026-109954 Fix available 8.3 HighOctober 13, 2026
• parse-community parse-server Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query CVE-2026-109303 Fix available 5.3 MediumOctober 12, 2026
• parse-community parse-server Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries CVE-2026-109302 Fix available 6.3 MediumOctober 12, 2026
• parse-community parse-server Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL CVE-2026-109301 Fix available 8.2 HighOctober 12, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors CVE-2026-105828 Fix available 6.3 MediumOctober 8, 2026
• parse-community parse-server Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity CVE-2026-101042 Fix available 7.4 HighSeptember 27, 2026
• parse-community parse-server Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery CVE-2026-100632 Fix available 7.1 HighSeptember 26, 2026
• parse-community parse-server Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection CVE-2026-100631 Fix available 8.7 HighSeptember 26, 2026
• parse-community parse-server Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password CVE-2026-87806 Fix available 9.1 CriticalSeptember 9, 2026
• parse-community parse-server Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages CVE-2026-66009 Fix available 6.3 MediumJuly 24, 2026
• parse-community parse-server Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages CVE-2026-66008 Fix available 6.3 MediumJuly 24, 2026
• parse-community parse-server Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion CVE-2026-64627 Fix available 6.9 MediumJuly 21, 2026
• parse-community parse-server Parse Server 9.0.0 Stored XSS via malformed Content-Type CVE-2026-61448 Fix available 2.1 LowJuly 11, 2026
• parse-community parse-server Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change CVE-2026-57481 Fix available 2.3 LowJune 19, 2026
• parse-community parse-server Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist CVE-2026-55778 Fix available 2.1 LowJune 19, 2026
• parse-community parse-server Parse Server: Denial of service via exponential-time processing of deeply nested query operators CVE-2026-57480 Fix available 8.7 HighJune 19, 2026
• parse-community parse-server Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL CVE-2026-53726 Fix available 6.9 MediumJune 12, 2026
• parse-community parse-server Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied CVE-2026-53725 Fix available 5.9 MediumJune 12, 2026
• parse-community parse-server Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist CVE-2026-53724 Fix available 2.1 LowJune 12, 2026
• parse-community parse-server Parse Server: Server option routeAllowList is bypassable through batch sub-requests CVE-2026-50008 Fix available 6.9 MediumJune 12, 2026
• parse-community parse-server Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers CVE-2026-47248 Fix available 6.9 MediumMay 29, 2026
• parse-community parse-server Parse Server: Pre-authentication denial of service via client version header regex backtracking CVE-2026-47138 Fix available 8.7 HighMay 23, 2026
• parse-community parse-server Parse Server: MFA SMS one-time password accepted twice under concurrent login CVE-2026-43930 Fix available 2.1 LowMay 5, 2026
• parse-community parse-server Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` CVE-2026-39381 Fix available 5.3 MediumApril 7, 2026
• parse-community parse-server Parse Server has a login timing side-channel reveals user existence CVE-2026-39321 Fix available 6.3 MediumApril 7, 2026
• parse-community parse-server Parse Server has a file upload Content-Type override via extension mismatch CVE-2026-35200 Fix available 2.1 LowApril 4, 2026
• parse-community parse-server Parse Server: Streaming file download bypasses afterFind file trigger authorization CVE-2026-34784 Fix available 8.2 HighMarch 31, 2026
• parse-community parse-server Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value CVE-2026-34595 Fix available 5.3 MediumMarch 31, 2026
• parse-community parse-server Parse Server: Session field immutability bypass via falsy-value guard CVE-2026-34574 Fix available 5.3 MediumMarch 31, 2026
• parse-community parse-server Parse Server: GraphQL complexity validator exponential fragment traversal DoS CVE-2026-34573 Fix available 8.2 HighMarch 31, 2026
• parse-community parse-server Parse Server: Cloud function validator bypass via prototype chain traversal CVE-2026-34532 Fix available 9.1 CriticalMarch 31, 2026
• parse-community parse-server Parse Server: GraphQL API endpoint ignores CORS origin restriction CVE-2026-34373 Fix available 5.3 MediumMarch 30, 2026
• parse-community parse-server Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers CVE-2026-34363 Fix available 8.2 HighMarch 30, 2026
• parse-community parse-server Parse Server: MFA single-use token bypass via concurrent authData login requests CVE-2026-34224 Fix available 2.1 LowMarch 29, 2026
• parse-community parse-server Parse Server: Auth data exposed via verify password endpoint CVE-2026-34215 Fix available 8.2 HighMarch 29, 2026
• Show olderLoading…