Parse-community vulnerabilities
157 CVEs and advisories name Parse-community as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124425Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response
- CVE-2026-123487Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex
- CVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
- CVE-2026-121965Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
- CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
- CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
- CVE-2026-121413Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
- CVE-2026-120310Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
- CVE-2026-119571Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
- CVE-2026-119570Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses
- CVE-2026-119569Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
- CVE-2026-119126Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
- CVE-2026-119125Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
- CVE-2026-116801Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
- CVE-2026-116165Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
- CVE-2026-116164Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
- CVE-2026-116163Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
- CVE-2026-116162Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
- CVE-2026-116161Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
- CVE-2026-112769Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
- CVE-2026-112768Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
- CVE-2026-110854Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
- CVE-2026-109954Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
- CVE-2026-109303Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query
- CVE-2026-109302Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
- CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL
- CVE-2026-105828Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors
- CVE-2026-101042Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
- CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery
- CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection