Skip to contentParse-community Parse-server vulnerabilities
- parse-community parse-serverParse Server: Auth data exposed via /users/me endpointCVE-2026-33627Fix available7.1 High
- parse-community parse-serverParse Server: MFA recovery code single-use bypass via concurrent requestsCVE-2026-33624Fix available2.1 Low
- parse-community parse-serverParse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapterCVE-2026-33539Fix available8.6 High
- parse-community parse-serverParse Server: Denial of service via unindexed database query for unconfigured auth providersCVE-2026-33538Fix available8.7 High
- parse-community parse-serverParse Server: Session update endpoint allows overwriting server-generated session fieldsCVE-2026-33527Fix available5.3 Medium
- parse-community parse-serverParse Server: LiveQuery subscription query depth bypassCVE-2026-33508Fix available8.2 High
- parse-community parse-serverParse Server: Query condition depth bypass via pre-validation transform pipelineCVE-2026-33498Fix available8.7 High
- parse-community parse-serverParse Server: Protected field change detection oracle via LiveQuery watch parameterCVE-2026-33429Fix available6.3 Medium
- parse-community parse-serverParse Server: LiveQuery bypasses CLP pointer permission enforcementCVE-2026-33421Fix available7.1 High
- parse-community parse-serverParse Server: Auth provider validation bypass on login via partial authDataCVE-2026-33409Fix available7.0 High
- parse-community parse-serverParse Server: Email verification resend page leaks user existenceCVE-2026-33323Fix available6.3 Medium
- parse-community parse-serverParse Server leaks protected fields via LiveQuery afterEvent triggerCVE-2026-33163Fix available8.2 High
- parse-community parse-serverParse Server affected by empty authData bypassing credential requirement on signupCVE-2026-33042Fix available6.9 Medium
- parse-community parse-serverParse Server: LiveQuery subscription with invalid regular expression crashes serverCVE-2026-32770Fix available5.9 Medium
- parse-community parse-serverParse Server session creation endpoint allows overwriting server-generated session fieldsCVE-2026-32742Fix available4.3 Medium
- parse-community parse-serverParse Server vulnerable to schema poisoning via prototype pollution in deep copyCVE-2026-32878Fix available5.3 Medium
- parse-community parse-serverParse Server's Cloud function dispatch crashes server via prototype chain traversalCVE-2026-32886Fix available8.2 High
- parse-community parse-serverParse Server has a password reset token single-use bypass via concurrent requestsCVE-2026-32943Fix available2.3 Low
- parse-community parse-serverParse Server crash via deeply nested query condition operatorsCVE-2026-32944Fix available8.7 High
- parse-community parse-serverParse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesCVE-2026-32728Fix available8.3 High
- parse-community parse-serverParse Server GraphQL WebSocket endpoint bypasses security middlewareCVE-2026-32594Fix available6.9 Medium
- parse-community parse-serverParse Server OAuth2 adapter app ID validation sends wrong token to introspection endpointCVE-2026-32269Fix available6.3 Medium
- parse-community parse-serverParse Server: Account takeover via operator injection in authentication data identifierCVE-2026-32248Fix available9.3 Critical
- parse-community parse-serverParse Server OAuth2 adapter shares mutable state across providers via singleton instanceCVE-2026-32242Fix available9.1 Critical
- parse-community parse-serverParse Server has a SQL injection via query field name when using PostgreSQLCVE-2026-32234Fix available5.1 Medium
- parse-community parse-serverParse Server has a protected fields bypass via LiveQuery subscription WHERE clauseCVE-2026-32098Fix available6.9 Medium
- parse-community parse-serverParse Server has user enumeration via email verification endpointCVE-2026-31901Fix available6.3 Medium
- parse-community parse-serverParse Server MFA recovery codes not consumed after useCVE-2026-31875Fix available8.2 High
- parse-community parse-serverParse Server has a protected fields bypass via dot-notation in query and sortCVE-2026-31872Fix available8.7 High
- parse-community parse-serverParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLCVE-2026-31871Fix available9.3 Critical
- parse-community parse-serverParse Server has Stored XSS via file upload of HTML-renderable file typesCVE-2026-31868Fix available6.3 Medium
- parse-community parse-serverParse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLCVE-2026-31856Fix available9.3 Critical
- parse-community parse-serverParse Server has an LDAP injection via unsanitized user input in DN and group filter constructionCVE-2026-31828Fix available6.0 Medium
- parse-community parse-serverParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesCVE-2026-31800Fix available8.8 High
- parse-community parse-serverParse Server has a rate limit bypass via batch request endpointCVE-2026-30972Fix available6.9 Medium
- parse-community parse-serverParse Server OAuth2 authentication adapter account takeover via identity spoofingCVE-2026-30967Fix available7.6 High
- parse-community parse-serverParse Server role escalation and CLP bypass via direct `_Join` table writeCVE-2026-30966Fix available10.0 Critical
- parse-community parse-serverParse Server session token exfiltration via `redirectClassNameForKey` query parameterCVE-2026-30965Fix available9.9 Critical
- parse-community parse-serverParse Server has a protected fields bypass via logical query operatorsCVE-2026-30962Fix available7.1 High
- parse-community parse-serverParse Server is missing audience validation in Keycloak authentication adapterCVE-2026-30949Fix available7.6 High
- parse-community parse-serverParse Server has stored cross-site scripting (XSS) via SVG file uploadCVE-2026-30948Fix available8.3 High
- parse-community parse-serverParse Server ha a bypass of class-level permissions in LiveQueryCVE-2026-30947Fix available8.7 High
- parse-community parse-serverParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APICVE-2026-30946Fix available8.7 High
- parse-community parse-serverParse Server has a SQL injection via dot-notation field name in PostgreSQLCVE-2026-31840Fix available9.3 Critical
- parse-community parse-serverParse Server has a NoSQL injection via token type in password reset and email verification endpointsCVE-2026-30941Fix available8.7 High
- parse-community parse-serverParse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain ResolutionCVE-2026-30939Fix available8.8 High
- parse-community parse-serverParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementCVE-2026-30938Fix available6.9 Medium
- parse-community parse-serverParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryCVE-2026-30925Fix available8.2 High
- parse-community parse-serverParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledCVE-2026-30854Fix available6.9 Medium
- parse-community parse-serverParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationCVE-2026-30850Fix available6.3 Medium
- Show moreLoading…