Skip to contentParseplatform Parse-server vulnerabilities
- parse-community parse-serverParse Server session token exfiltration via `redirectClassNameForKey` query parameterCVE-2026-30965Fix available9.9 Critical
- parse-community parse-serverParse Server has a protected fields bypass via logical query operatorsCVE-2026-30962Fix available7.1 High
- parse-community parse-serverParse Server is missing audience validation in Keycloak authentication adapterCVE-2026-30949Fix available7.6 High
- parse-community parse-serverParse Server has stored cross-site scripting (XSS) via SVG file uploadCVE-2026-30948Fix available8.3 High
- parse-community parse-serverParse Server ha a bypass of class-level permissions in LiveQueryCVE-2026-30947Fix available8.7 High
- parse-community parse-serverParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APICVE-2026-30946Fix available8.7 High
- parse-community parse-serverParse Server has a SQL injection via dot-notation field name in PostgreSQLCVE-2026-31840Fix available9.3 Critical
- parse-community parse-serverParse Server has a NoSQL injection via token type in password reset and email verification endpointsCVE-2026-30941Fix available8.7 High
- parse-community parse-serverParse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain ResolutionCVE-2026-30939Fix available8.8 High
- parse-community parse-serverParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementCVE-2026-30938Fix available6.9 Medium
- parse-community parse-serverParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryCVE-2026-30925Fix available8.2 High
- parse-community parse-serverParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledCVE-2026-30854Fix available6.9 Medium
- parse-community parse-serverParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationCVE-2026-30850Fix available6.3 Medium
- parse-community parse-serverParse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryCVE-2026-30848Fix available6.3 Medium
- parse-community parse-serverParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adaptersCVE-2026-30863Fix available9.3 Critical
- parse-community parse-serverParse Server: Malformed `$regex` query leaks database error details in API responseCVE-2026-30835Fix available6.9 Medium
- parse-community parse-serverParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any userCVE-2026-30229Fix available8.5 High
- parse-community parse-serverParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionCVE-2026-30228Fix available6.9 Medium
- parse-community parse-serverParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionCVE-2026-29182Fix available8.6 High
- parse-community parse-serverParse Server: Account takeover via JWT algorithm confusion in Google auth adapterCVE-2026-27804Fix available9.3 Critical
- parse-community parse-serverParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth AdapterCVE-2025-68150Fix available8.3 High
- parse-community parse-serverParse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template VariablesCVE-2025-68115Fix available5.3 Medium
- parse-community parse-serverParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege ManagementCVE-2025-67727Public exploitFix available6.9 Medium
- parse community server, parse-community parse-server +1 moreParse Server's custom object ID allows to acquire role privilegesCVE-2024-47183Fix available8.1 High
- parse community server, parse-community parse-server +1 moreParse Server crash and RCE via invalid Cloud Function or Cloud Job nameCVE-2024-29027Fix available9.1 Critical
- parse-community parse-serverParse Server literalizeRegexPart SQL InjectionCVE-2024-27298Fix available10.0 Critical
- parse community server, parse-community parse-server +1 moreParse Server may crash when uploading file without extensionCVE-2023-46119Fix available7.5 High
- parse-community parse-serverTrigger `beforeFind` not invoked in internal query pipeline in parse-serverCVE-2023-41058Fix available7.5 High
- parse-community parse-serverParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionCVE-2023-36475Fix available9.8 Critical
- parse-community parse-serverParse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML fileCVE-2023-32689Fix available6.3 Medium
- parseplatform parse server, parse-community parse-server +1 moreParse Server is vulnerable to authentication bypass via spoofingCVE-2023-22474Fix available8.7 High
- parse-community parse-serverParse Server subject to Prototype pollution via Cloud Code WebhooksCVE-2022-41879Fix available7.2 High
- parse-community parse-serverParse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code TriggersCVE-2022-41878Fix available7.2 High
- parse-community parse-serverParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserCVE-2022-39396Fix availableEPSS 39.4%9.8 Critical
- parse-community parse-serverParse Server crashes when receiving file download request with invalid byte rangeCVE-2022-39313Fix available7.5 High
- parse-community parse-serverParse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventedCVE-2022-39231Fix available3.7 Low
- parse-community parse-serverParse Server subject to Incorrect Resource Transfer Between SpheresCVE-2022-39225Fix available4.3 Medium
- parse-community parse-serverParse Server vulnerable to brute force guessing of user sensitive data via search patternsCVE-2022-36079Fix available8.6 High
- parse-community parse-serverProtected fields exposed via LiveQuery in parse-serverCVE-2022-31112Fix available8.2 High
- parse-community parse-serverInvalid file request can crashe parse-serverCVE-2022-31089Fix available7.5 High
- parse-community parse-serverAuthentication bypass in Parse Server Apple Game Center auth adapterCVE-2022-31083Fix available8.6 High
- parse-community parse-serverAuthentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapterCVE-2022-24901Fix available7.5 High
- parse-community parse-serverCommand Injection in Parse serverCVE-2022-24760Public exploitFix availableEPSS 49.4%10.0 Critical
- parse-community parse-serverLiveQuery publishes user session tokensCVE-2021-41109Fix available7.5 High
- parse-community parse-serverParse Server - Unreviewed Code Execution via Malicious Version TagsCVE-2021-47986Fix available7.7 High
- parse-community parse-serverCrash server with query parameterCVE-2021-39187Fix available7.5 High
- parse-community parse-serverNew anonymous user session acts as if it's created with passwordCVE-2021-39138Fix available4.8 Medium
- parse-community parse-serverParse Server stores password in plain textCVE-2020-26288Fix available7.7 High
- parse-community parse-serverImproper session expiration in Parse ServerCVE-2020-15270Fix available4.3 Medium
- parse-community parse-serverInformation disclosure in parse-serverCVE-2020-5251Fix available7.7 High
- Show moreLoading…