CVEs we hold for Parse-community
Records whose assigning authority named Parse-community as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Passwordparse-community parse-server
CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error Messagesparse-community parse-server
CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error Messagesparse-community parse-server
CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercionparse-community parse-server
CVE-2026-57481Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access changeparse-community parse-server
CVE-2026-57480Parse Server: Denial of service via exponential-time processing of deeply nested query operatorsparse-community parse-server
CVE-2026-55778Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklistparse-community parse-server
CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLparse-community parse-server
CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is…parse-community parse-server
CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistparse-community parse-server
CVE-2026-50008Parse Server: Server option routeAllowList is bypassable through batch sub-requestsparse-community parse-server
CVE-2026-47248Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersparse-community parse-server
CVE-2026-47138Parse Server: Pre-authentication denial of service via client version header regex backtrackingparse-community parse-server
CVE-2026-43930Parse Server: MFA SMS one-time password accepted twice under concurrent loginparse-community parse-server
CVE-2026-39381Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`parse-community parse-server
CVE-2026-39321Parse Server has a login timing side-channel reveals user existenceparse-community parse-server
CVE-2026-35200Parse Server has a file upload Content-Type override via extension mismatchparse-community parse-server
CVE-2026-34784Parse Server: Streaming file download bypasses afterFind file trigger authorizationparse-community parse-server
CVE-2026-34595Parse Server: LiveQuery protected-field guard bypass via array-like logical operator valueparse-community parse-server
CVE-2026-34574Parse Server: Session field immutability bypass via falsy-value guardparse-community parse-server
CVE-2026-34573Parse Server: GraphQL complexity validator exponential fragment traversal DoSparse-community parse-server
CVE-2026-34532Parse Server: Cloud function validator bypass via prototype chain traversalparse-community parse-server
CVE-2026-34373Parse Server: GraphQL API endpoint ignores CORS origin restrictionparse-community parse-server
CVE-2026-34363Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersparse-community parse-server
CVE-2026-34224Parse Server: MFA single-use token bypass via concurrent authData login requestsparse-community parse-server
CVE-2026-34215Parse Server: Auth data exposed via verify password endpointparse-community parse-server
CVE-2026-33624Parse Server: MFA recovery code single-use bypass via concurrent requestsparse-community parse-server
CVE-2026-33539Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapterparse-community parse-server
CVE-2026-33538Parse Server: Denial of service via unindexed database query for unconfigured auth providersparse-community parse-server
CVE-2026-33527Parse Server: Session update endpoint allows overwriting server-generated session fieldsparse-community parse-server
CVE-2026-33498Parse Server: Query condition depth bypass via pre-validation transform pipelineparse-community parse-server
CVE-2026-33429Parse Server: Protected field change detection oracle via LiveQuery watch parameterparse-community parse-server
CVE-2026-33421Parse Server: LiveQuery bypasses CLP pointer permission enforcementparse-community parse-server
CVE-2026-33409Parse Server: Auth provider validation bypass on login via partial authDataparse-community parse-server
CVE-2026-33323Parse Server: Email verification resend page leaks user existenceparse-community parse-server
CVE-2026-33163Parse Server leaks protected fields via LiveQuery afterEvent triggerparse-community parse-server
CVE-2026-33042Parse Server affected by empty authData bypassing credential requirement on signupparse-community parse-server
CVE-2026-32944Parse Server crash via deeply nested query condition operatorsparse-community parse-server
CVE-2026-32943Parse Server has a password reset token single-use bypass via concurrent requestsparse-community parse-server
CVE-2026-32886Parse Server's Cloud function dispatch crashes server via prototype chain traversalparse-community parse-server
CVE-2026-32878Parse Server vulnerable to schema poisoning via prototype pollution in deep copyparse-community parse-server
CVE-2026-32770Parse Server: LiveQuery subscription with invalid regular expression crashes serverparse-community parse-server
CVE-2026-32742Parse Server session creation endpoint allows overwriting server-generated session fieldsparse-community parse-server
CVE-2026-32728Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesparse-community parse-server
CVE-2026-32594Parse Server GraphQL WebSocket endpoint bypasses security middlewareparse-community parse-server
CVE-2026-32269Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpointparse-community parse-server
CVE-2026-32248Parse Server: Account takeover via operator injection in authentication data identifierparse-community parse-server
CVE-2026-32242Parse Server OAuth2 adapter shares mutable state across providers via singleton instanceparse-community parse-server
CVE-2026-32234Parse Server has a SQL injection via query field name when using PostgreSQLparse-community parse-server
CVE-2026-32098Parse Server has a protected fields bypass via LiveQuery subscription WHERE clauseparse-community parse-server
CVE-2026-31901Parse Server has user enumeration via email verification endpointparse-community parse-server
CVE-2026-31872Parse Server has a protected fields bypass via dot-notation in query and sortparse-community parse-server
CVE-2026-31871Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLparse-community parse-server
CVE-2026-31868Parse Server has Stored XSS via file upload of HTML-renderable file typesparse-community parse-server
CVE-2026-31856Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLparse-community parse-server
CVE-2026-31840Parse Server has a SQL injection via dot-notation field name in PostgreSQLparse-community parse-server
CVE-2026-31828Parse Server has an LDAP injection via unsanitized user input in DN and group filter constructionparse-community parse-server
CVE-2026-31800Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesparse-community parse-server
CVE-2026-30972Parse Server has a rate limit bypass via batch request endpointparse-community parse-server
CVE-2026-30967Parse Server OAuth2 authentication adapter account takeover via identity spoofingparse-community parse-server
CVE-2026-30966Parse Server role escalation and CLP bypass via direct `_Join` table writeparse-community parse-server
CVE-2026-30965Parse Server session token exfiltration via `redirectClassNameForKey` query parameterparse-community parse-server
CVE-2026-30962Parse Server has a protected fields bypass via logical query operatorsparse-community parse-server
CVE-2026-30949Parse Server is missing audience validation in Keycloak authentication adapterparse-community parse-server
CVE-2026-30948Parse Server has stored cross-site scripting (XSS) via SVG file uploadparse-community parse-server
CVE-2026-30947Parse Server ha a bypass of class-level permissions in LiveQueryparse-community parse-server
CVE-2026-30946Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APIparse-community parse-server
CVE-2026-30941Parse Server has a NoSQL injection via token type in password reset and email verification endpointsparse-community parse-server
CVE-2026-30939Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolutionparse-community parse-server
CVE-2026-30938Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementparse-community parse-server
CVE-2026-30925Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryparse-community parse-server
CVE-2026-30863Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adaptersparse-community parse-server
CVE-2026-30854Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledparse-community parse-server
CVE-2026-30850Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationparse-community parse-server
CVE-2026-30848Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryparse-community parse-server
CVE-2026-30835Parse Server: Malformed `$regex` query leaks database error details in API responseparse-community parse-server
CVE-2026-30229Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any userparse-community parse-server
CVE-2026-30228Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionparse-community parse-server
CVE-2026-29182Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionparse-community parse-server
CVE-2026-27804Parse Server: Account takeover via JWT algorithm confusion in Google auth adapterparse-community parse-server
CVE-2026-27610Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessionsparse-community parse-dashboard
CVE-2026-27609Parse Dashboard Missing CSRF Protection on Agent Endpointparse-community parse-dashboard
CVE-2026-27608Parse Dashboard Missing Authorization on Agent Endpointparse-community parse-dashboard
CVE-2026-27595Parse Dashboard has incomplete authentication on AI Agent endpointparse-community parse-dashboard
CVE-2025-68150Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapterparse-community parse-server
CVE-2025-68115Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variablesparse-community parse-server
CVE-2025-67727Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Managementparse-community parse-server
CVE-2025-64502Parse Server allows public `explain` queries which may expose sensitive database performance information and schema…parse-community parse-server
CVE-2025-64430Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Formatparse-community parse-server
CVE-2025-62374Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsparse-community Parse-SDK-JS
CVE-2024-47183Parse Server's custom object ID allows to acquire role privilegesparse-community parse-server
CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerabilityparse-community parse-server
CVE-2024-29027Parse Server crash and RCE via invalid Cloud Function or Cloud Job nameparse-community parse-server
CVE-2023-46119Parse Server may crash when uploading file without extensionparse-community parse-server
CVE-2023-41058Trigger `beforeFind` not invoked in internal query pipeline in parse-serverparse-community parse-server
CVE-2023-36475Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionparse-community parse-server
CVE-2023-32689Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML fileparse-community parse-server
CVE-2023-32688Invalid push request payload crashes Parse Serverparse-community parse-server-push-adapter
CVE-2023-22474Parse Server is vulnerable to authentication bypass via spoofingparse-community parse-server
CVE-2022-41879Parse Server subject to Prototype pollution via Cloud Code Webhooksparse-community parse-server
CVE-2022-41878Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggersparse-community parse-server
CVE-2022-39396Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserparse-community parse-server
CVE-2022-39313Parse Server crashes when receiving file download request with invalid byte rangeparse-community parse-server
CVE-2022-39231Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventedparse-community parse-server
CVE-2022-39225Parse Server subject to Incorrect Resource Transfer Between Spheresparse-community parse-server
CVE-2022-36079Parse Server vulnerable to brute force guessing of user sensitive data via search patternsparse-community parse-server
CVE-2022-31083Authentication bypass in Parse Server Apple Game Center auth adapterparse-community parse-server
CVE-2022-24901Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapterparse-community parse-server
CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tagsparse-community parse-server
CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tagsparse-community parse-server
CVE-2021-39138New anonymous user session acts as if it's created with passwordparse-community parse-server
CVE-2020-15126Information disclosure through Viewer query in parse-serverparse-community parse-server
127 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.