Parseplatform Parse-server vulnerabilities

• parse-community parse-server Parse Server: MFA SMS one-time password accepted twice under concurrent login CVE-2026-43930 Fix available 2.1 LowMay 5, 2026
• parse-community parse-server Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` CVE-2026-39381 Fix available 5.3 MediumApril 7, 2026
• parse-community parse-server Parse Server has a login timing side-channel reveals user existence CVE-2026-39321 Fix available 6.3 MediumApril 7, 2026
• parse-community parse-server Parse Server has a file upload Content-Type override via extension mismatch CVE-2026-35200 Fix available 2.1 LowApril 4, 2026
• parse-community parse-server Parse Server: Streaming file download bypasses afterFind file trigger authorization CVE-2026-34784 Fix available 8.2 HighMarch 31, 2026
• parse-community parse-server Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value CVE-2026-34595 Fix available 5.3 MediumMarch 31, 2026
• parse-community parse-server Parse Server: Session field immutability bypass via falsy-value guard CVE-2026-34574 Fix available 5.3 MediumMarch 31, 2026
• parse-community parse-server Parse Server: GraphQL complexity validator exponential fragment traversal DoS CVE-2026-34573 Fix available 8.2 HighMarch 31, 2026
• parse-community parse-server Parse Server: Cloud function validator bypass via prototype chain traversal CVE-2026-34532 Fix available 9.1 CriticalMarch 31, 2026
• parse-community parse-server Parse Server: GraphQL API endpoint ignores CORS origin restriction CVE-2026-34373 Fix available 5.3 MediumMarch 30, 2026
• parse-community parse-server Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers CVE-2026-34363 Fix available 8.2 HighMarch 30, 2026
• parse-community parse-server Parse Server: MFA single-use token bypass via concurrent authData login requests CVE-2026-34224 Fix available 2.1 LowMarch 29, 2026
• parse-community parse-server Parse Server: Auth data exposed via verify password endpoint CVE-2026-34215 Fix available 8.2 HighMarch 29, 2026
• parse-community parse-server Parse Server: Auth data exposed via /users/me endpoint CVE-2026-33627 Fix available 7.1 HighMarch 24, 2026
• parse-community parse-server Parse Server: MFA recovery code single-use bypass via concurrent requests CVE-2026-33624 Fix available 2.1 LowMarch 24, 2026
• parse-community parse-server Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter CVE-2026-33539 Fix available 8.6 HighMarch 24, 2026
• parse-community parse-server Parse Server: Denial of service via unindexed database query for unconfigured auth providers CVE-2026-33538 Fix available 8.7 HighMarch 24, 2026
• parse-community parse-server Parse Server: Session update endpoint allows overwriting server-generated session fields CVE-2026-33527 Fix available 5.3 MediumMarch 24, 2026
• parse-community parse-server Parse Server: LiveQuery subscription query depth bypass CVE-2026-33508 Fix available 8.2 HighMarch 20, 2026
• parse-community parse-server Parse Server: Query condition depth bypass via pre-validation transform pipeline CVE-2026-33498 Fix available 8.7 HighMarch 20, 2026
• parse-community parse-server Parse Server: Protected field change detection oracle via LiveQuery watch parameter CVE-2026-33429 Fix available 6.3 MediumMarch 20, 2026
• parse-community parse-server Parse Server: LiveQuery bypasses CLP pointer permission enforcement CVE-2026-33421 Fix available 7.1 HighMarch 20, 2026
• parse-community parse-server Parse Server: Auth provider validation bypass on login via partial authData CVE-2026-33409 Fix available 7.0 HighMarch 19, 2026
• parse-community parse-server Parse Server: Email verification resend page leaks user existence CVE-2026-33323 Fix available 6.3 MediumMarch 19, 2026
• parse-community parse-server Parse Server leaks protected fields via LiveQuery afterEvent trigger CVE-2026-33163 Fix available 8.2 HighMarch 18, 2026
• parse-community parse-server Parse Server affected by empty authData bypassing credential requirement on signup CVE-2026-33042 Fix available 6.9 MediumMarch 17, 2026
• parse-community parse-server Parse Server: LiveQuery subscription with invalid regular expression crashes server CVE-2026-32770 Fix available 5.9 MediumMarch 17, 2026
• parse-community parse-server Parse Server session creation endpoint allows overwriting server-generated session fields CVE-2026-32742 Fix available 4.3 MediumMarch 17, 2026
• parse-community parse-server Parse Server vulnerable to schema poisoning via prototype pollution in deep copy CVE-2026-32878 Fix available 5.3 MediumMarch 17, 2026
• parse-community parse-server Parse Server's Cloud function dispatch crashes server via prototype chain traversal CVE-2026-32886 Fix available 8.2 HighMarch 17, 2026
• parse-community parse-server Parse Server has a password reset token single-use bypass via concurrent requests CVE-2026-32943 Fix available 2.3 LowMarch 17, 2026
• parse-community parse-server Parse Server crash via deeply nested query condition operators CVE-2026-32944 Fix available 8.7 HighMarch 17, 2026
• parse-community parse-server Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries CVE-2026-32728 Fix available 8.3 HighMarch 16, 2026
• parse-community parse-server Parse Server GraphQL WebSocket endpoint bypasses security middleware CVE-2026-32594 Fix available 6.9 MediumMarch 13, 2026
• parse-community parse-server Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint CVE-2026-32269 Fix available 6.3 MediumMarch 12, 2026
• parse-community parse-server Parse Server: Account takeover via operator injection in authentication data identifier CVE-2026-32248 Fix available 9.3 CriticalMarch 12, 2026
• parse-community parse-server Parse Server OAuth2 adapter shares mutable state across providers via singleton instance CVE-2026-32242 Fix available 9.1 CriticalMarch 12, 2026
• parse-community parse-server Parse Server has a SQL injection via query field name when using PostgreSQL CVE-2026-32234 Fix available 5.1 MediumMarch 11, 2026
• parse-community parse-server Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause CVE-2026-32098 Fix available 6.9 MediumMarch 11, 2026
• parse-community parse-server Parse Server has user enumeration via email verification endpoint CVE-2026-31901 Fix available 6.3 MediumMarch 11, 2026
• parse-community parse-server Parse Server MFA recovery codes not consumed after use CVE-2026-31875 Fix available 8.2 HighMarch 11, 2026
• parse-community parse-server Parse Server has a protected fields bypass via dot-notation in query and sort CVE-2026-31872 Fix available 8.7 HighMarch 11, 2026
• parse-community parse-server Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL CVE-2026-31871 Fix available 9.3 CriticalMarch 11, 2026
• parse-community parse-server Parse Server has Stored XSS via file upload of HTML-renderable file types CVE-2026-31868 Fix available 6.3 MediumMarch 11, 2026
• parse-community parse-server Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL CVE-2026-31856 Fix available 9.3 CriticalMarch 11, 2026
• parse-community parse-server Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction CVE-2026-31828 Fix available 6.0 MediumMarch 10, 2026
• parse-community parse-server Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes CVE-2026-31800 Fix available 8.8 HighMarch 10, 2026
• parse-community parse-server Parse Server has a rate limit bypass via batch request endpoint CVE-2026-30972 Fix available 6.9 MediumMarch 10, 2026
• parse-community parse-server Parse Server OAuth2 authentication adapter account takeover via identity spoofing CVE-2026-30967 Fix available 7.6 HighMarch 10, 2026
• parse-community parse-server Parse Server role escalation and CLP bypass via direct `_Join` table write CVE-2026-30966 Fix available 10.0 CriticalMarch 10, 2026
• Show olderLoading…