Skip to main content
cve.nowby Sazabi
← npm
npmPackage

parse-dashboard

4 known vulnerabilities (2 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
10.0.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
10.0.0 (Nov 4, 2026), the latest release
Advisories
4 · 2 critical, 2 high
Weekly downloads
17.4K
Dependents
1
Releases
500+ since 1.0.9 (Apr 15, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-27595
    Affects 7.3.0-alpha.42 to 9.0.0-alpha.7 (9.0.0-alpha.8 is outside it)
  • CVE-2026-27610
    Affects 7.3.0-alpha.42 to 9.0.0-alpha.7 (9.0.0-alpha.8 is outside it)
  • CVE-2026-27609
    Affects 7.3.0-alpha.42 to 9.0.0-alpha.7 (9.0.0-alpha.8 is outside it)
  • CVE-2026-27608
    Affects 7.3.0-alpha.42 to 9.0.0-alpha.7 (9.0.0-alpha.8 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 4

  • CVE-2026-27595Critical 9.9

    Parse Dashboard has incomplete authentication on AI Agent endpoint

    Affected: from 7.3.0-alpha.42, fixed in 9.0.0-alpha.8.

    Fixed in 9.0.0-alpha.8 (released Feb 19, 2026, 6 days before disclosure).

    The latest release, 10.0.0, is not affected.

    14% of parse-dashboard downloads last week were affected versions (1.7K).

  • Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

    Affected: from 7.3.0-alpha.42, fixed in 9.0.0-alpha.8.

    Fixed in 9.0.0-alpha.8 (released Feb 19, 2026, 6 days before disclosure).

    The latest release, 10.0.0, is not affected.

    14% of parse-dashboard downloads last week were affected versions (1.7K).

  • Parse Dashboard Missing CSRF Protection on Agent Endpoint

    Affected: from 7.3.0-alpha.42, fixed in 9.0.0-alpha.8.

    Fixed in 9.0.0-alpha.8 (released Feb 19, 2026, 6 days before disclosure).

    The latest release, 10.0.0, is not affected.

    14% of parse-dashboard downloads last week were affected versions (1.7K).

  • CVE-2026-27608Critical 9.3

    Parse Dashboard Missing Authorization on Agent Endpoint

    Affected: from 7.3.0-alpha.42, fixed in 9.0.0-alpha.8.

    Fixed in 9.0.0-alpha.8 (released Feb 19, 2026, 6 days before disclosure).

    The latest release, 10.0.0, is not affected.

    14% of parse-dashboard downloads last week were affected versions (1.7K).