Skip to contentParse-community vulnerabilities
Newest
- parse-community parse-serverParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryCVE-2026-30925Fix available8.2 High
- parse-community parse-serverParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledCVE-2026-30854Fix available6.9 Medium
- parse-community parse-serverParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationCVE-2026-30850Fix available6.3 Medium
- parse-community parse-serverParse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryCVE-2026-30848Fix available6.3 Medium
- parse-community parse-serverParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adaptersCVE-2026-30863Fix available9.3 Critical
- parse-community parse-serverParse Server: Malformed `$regex` query leaks database error details in API responseCVE-2026-30835Fix available6.9 Medium
- parse-community parse-serverParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any userCVE-2026-30229Fix available8.5 High
- parse-community parse-serverParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionCVE-2026-30228Fix available6.9 Medium
- parse-community parse-serverParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionCVE-2026-29182Fix available8.6 High
- parse-community parse-serverParse Server: Account takeover via JWT algorithm confusion in Google auth adapterCVE-2026-27804Fix available9.3 Critical
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard has incomplete authentication on AI Agent endpointCVE-2026-27595Fix available9.9 Critical
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsCVE-2026-27610Fix available7.0 High
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Missing CSRF Protection on Agent EndpointCVE-2026-27609Fix available8.3 High
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Missing Authorization on Agent EndpointCVE-2026-27608Fix available9.3 Critical
- parse-community parse-serverParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth AdapterCVE-2025-68150Fix available8.3 High
- parse-community parse-serverParse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template VariablesCVE-2025-68115Fix available5.3 Medium
- parse-community parse-serverParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege ManagementCVE-2025-67727Public exploitFix available6.9 Medium
- parse-community parse-serverParse Server allows public `explain` queries which may expose sensitive database performance information and schema detailsCVE-2025-64502Fix available6.9 Medium
- parse-community parse-serverParse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI FormatCVE-2025-64430Fix available7.5 High
- parse-community parse-sdk-jsParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsCVE-2025-62374Fix available6.4 Medium
- parse-community parse-serverParse Server exposes the data schema via GraphQL APICVE-2025-53364Fix available5.3 Medium
- parse-community parse-serverParse Server has an OAuth login vulnerabilityCVE-2025-30168Fix available6.9 Medium
- parse community server, parse-community parse-server +1 moreParse Server's custom object ID allows to acquire role privilegesCVE-2024-47183Fix available8.1 High
- parse community server, parse-community parse-server +1 moreZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass VulnerabilityCVE-2024-39309Public exploitFix availableEPSS 20.2%9.8 Critical
- parse community server, parse-community parse-server +1 moreParse Server crash and RCE via invalid Cloud Function or Cloud Job nameCVE-2024-29027Fix available9.1 Critical
- parse-community parse-serverParse Server literalizeRegexPart SQL InjectionCVE-2024-27298Fix available10.0 Critical
- parse community server, parse-community parse-server +1 moreParse Server may crash when uploading file without extensionCVE-2023-46119Fix available7.5 High
- parse-community parse-serverTrigger `beforeFind` not invoked in internal query pipeline in parse-serverCVE-2023-41058Fix available7.5 High
- parse-community parse-serverParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionCVE-2023-36475Fix available9.8 Critical
- parse-community parse-serverParse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML fileCVE-2023-32689Fix available6.3 Medium
- parse-community parse-server-push-adapter, parseplatform parse server push adapter +1 moreInvalid push request payload crashes Parse ServerCVE-2023-32688Fix available4.9 Medium
- parseplatform parse server, parse-community parse-server +1 moreParse Server is vulnerable to authentication bypass via spoofingCVE-2023-22474Fix available8.7 High
- parse-community parse-serverParse Server subject to Prototype pollution via Cloud Code WebhooksCVE-2022-41879Fix available7.2 High
- parse-community parse-serverParse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code TriggersCVE-2022-41878Fix available7.2 High
- parse-community parse-serverParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserCVE-2022-39396Fix availableEPSS 39.4%9.8 Critical
- parse-community parse-serverParse Server crashes when receiving file download request with invalid byte rangeCVE-2022-39313Fix available7.5 High
- parse-community parse-serverParse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventedCVE-2022-39231Fix available3.7 Low
- parse-community parse-serverParse Server subject to Incorrect Resource Transfer Between SpheresCVE-2022-39225Fix available4.3 Medium
- parse-community parse-serverParse Server vulnerable to brute force guessing of user sensitive data via search patternsCVE-2022-36079Fix available8.6 High
- parse-community parse-serverProtected fields exposed via LiveQuery in parse-serverCVE-2022-31112Fix available8.2 High
- parse-community parse-serverInvalid file request can crashe parse-serverCVE-2022-31089Fix available7.5 High
- parse-community parse-serverAuthentication bypass in Parse Server Apple Game Center auth adapterCVE-2022-31083Fix available8.6 High
- parse-community parse-serverAuthentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapterCVE-2022-24901Fix available7.5 High
- parse-community parse-serverCommand Injection in Parse serverCVE-2022-24760Public exploitFix availableEPSS 49.4%10.0 Critical
- parse-community parse-serverLiveQuery publishes user session tokensCVE-2021-41109Fix available7.5 High
- parse-community parse-serverParse Server - Arbitrary Code Execution via Malicious Version TagsCVE-2021-47987Fix available7.7 High
- parse-community parse-serverParse Server - Unreviewed Code Execution via Malicious Version TagsCVE-2021-47986Fix available7.7 High
- parse-community parse-serverCrash server with query parameterCVE-2021-39187Fix available7.5 High
- parse-community parse-serverNew anonymous user session acts as if it's created with passwordCVE-2021-39138Fix available4.8 Medium
- parse-community parse-serverParse Server stores password in plain textCVE-2020-26288Fix available7.7 High
- Show moreLoading…