# cve.now: Parse-community

The newest entries naming Parse-community as an affected vendor (up to 200), of 157 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124425](https://cve.now/CVE-2026-124425.md): Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response (CVSS 2.3)
- [CVE-2026-123487](https://cve.now/CVE-2026-123487.md): Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex (CVSS 8.7)
- [CVE-2026-122301](https://cve.now/CVE-2026-122301.md): Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response (CVSS 2.3)
- [CVE-2026-121965](https://cve.now/CVE-2026-121965.md): Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key (CVSS 6.0)
- [CVE-2026-121415](https://cve.now/CVE-2026-121415.md): Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key (CVSS 6.3)
- [CVE-2026-121414](https://cve.now/CVE-2026-121414.md): Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update (CVSS 8.2)
- [CVE-2026-121413](https://cve.now/CVE-2026-121413.md): Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession (CVSS 2.3)
- [CVE-2026-120310](https://cve.now/CVE-2026-120310.md): Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response (CVSS 2.3)
- [CVE-2026-119571](https://cve.now/CVE-2026-119571.md): Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID (CVSS 6.3)
- [CVE-2026-119570](https://cve.now/CVE-2026-119570.md): Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses (CVSS 2.3)
- [CVE-2026-119569](https://cve.now/CVE-2026-119569.md): Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service (CVSS 6.0)
- [CVE-2026-119126](https://cve.now/CVE-2026-119126.md): Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys (CVSS 2.3)
- [CVE-2026-119125](https://cve.now/CVE-2026-119125.md): Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields (CVSS 2.3)
- [CVE-2026-116801](https://cve.now/CVE-2026-116801.md): Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query (CVSS 5.3)
- [CVE-2026-116165](https://cve.now/CVE-2026-116165.md): Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB (CVSS 8.8)
- [CVE-2026-116164](https://cve.now/CVE-2026-116164.md): Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes (CVSS 6.3)
- [CVE-2026-116163](https://cve.now/CVE-2026-116163.md): Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses (CVSS 9.1)
- [CVE-2026-116162](https://cve.now/CVE-2026-116162.md): Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login (CVSS 2.1)
- [CVE-2026-116161](https://cve.now/CVE-2026-116161.md): Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions (CVSS 6.0)
- [CVE-2026-112769](https://cve.now/CVE-2026-112769.md): Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass (CVSS 2.3)
- [CVE-2026-112768](https://cve.now/CVE-2026-112768.md): Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update (CVSS 6.9)
- [CVE-2026-110854](https://cve.now/CVE-2026-110854.md): Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error (CVSS 8.2)
- [CVE-2026-109954](https://cve.now/CVE-2026-109954.md): Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference (CVSS 8.3)
- [CVE-2026-109303](https://cve.now/CVE-2026-109303.md): Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query (CVSS 5.3)
- [CVE-2026-109302](https://cve.now/CVE-2026-109302.md): Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries (CVSS 6.3)
- [CVE-2026-109301](https://cve.now/CVE-2026-109301.md): Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL (CVSS 8.2)
- [CVE-2026-105828](https://cve.now/CVE-2026-105828.md): Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors (CVSS 6.3)
- [CVE-2026-101042](https://cve.now/CVE-2026-101042.md): Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity (CVSS 7.4)
- [CVE-2026-100632](https://cve.now/CVE-2026-100632.md): Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery (CVSS 7.1)
- [CVE-2026-100631](https://cve.now/CVE-2026-100631.md): Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection (CVSS 8.7)
- [CVE-2026-87806](https://cve.now/CVE-2026-87806.md): Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password (CVSS 9.1)
- [CVE-2026-66009](https://cve.now/CVE-2026-66009.md): Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (CVSS 6.3)
- [CVE-2026-66008](https://cve.now/CVE-2026-66008.md): Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (CVSS 6.3)
- [CVE-2026-64627](https://cve.now/CVE-2026-64627.md): Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion (CVSS 6.9)
- [CVE-2026-61448](https://cve.now/CVE-2026-61448.md): Parse Server 9.0.0 Stored XSS via malformed Content-Type (CVSS 2.1)
- [CVE-2026-57481](https://cve.now/CVE-2026-57481.md): Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change (CVSS 2.3)
- [CVE-2026-57480](https://cve.now/CVE-2026-57480.md): Parse Server: Denial of service via exponential-time processing of deeply nested query operators (CVSS 8.7)
- [CVE-2026-55778](https://cve.now/CVE-2026-55778.md): Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist (CVSS 2.1)
- [CVE-2021-47987](https://cve.now/CVE-2021-47987.md): Parse Server - Arbitrary Code Execution via Malicious Version Tags (CVSS 7.7)
- [CVE-2021-47986](https://cve.now/CVE-2021-47986.md): Parse Server - Unreviewed Code Execution via Malicious Version Tags (CVSS 7.7)
- [CVE-2026-53726](https://cve.now/CVE-2026-53726.md): Parse Server: Relation \`$relatedTo\` query bypasses \`protectedFields\` and owning-object ACL (CVSS 6.9)
- [CVE-2026-53725](https://cve.now/CVE-2026-53725.md): Parse Server: Endpoints \`/login\` and \`/verifyPassword\` disclose MFA secrets and protected fields when \`\_User\` get is denied (CVSS 5.9)
- [CVE-2026-53724](https://cve.now/CVE-2026-53724.md): Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist (CVSS 2.1)
- [CVE-2026-50008](https://cve.now/CVE-2026-50008.md): Parse Server: Server option routeAllowList is bypassable through batch sub-requests (CVSS 6.9)
- [CVE-2026-47138](https://cve.now/CVE-2026-47138.md): Parse Server: Pre-authentication denial of service via client version header regex backtracking (CVSS 8.7)
- [CVE-2026-47248](https://cve.now/CVE-2026-47248.md): Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (CVSS 6.9)
- [CVE-2026-43930](https://cve.now/CVE-2026-43930.md): Parse Server: MFA SMS one-time password accepted twice under concurrent login (CVSS 2.1)
- [CVE-2026-39381](https://cve.now/CVE-2026-39381.md): Parse Server's Endpoint \`/sessions/me\` bypasses \`\_Session\` \`protectedFields\` (CVSS 5.3)
- [CVE-2026-39321](https://cve.now/CVE-2026-39321.md): Parse Server has a login timing side-channel reveals user existence (CVSS 6.3)
- [CVE-2026-35200](https://cve.now/CVE-2026-35200.md): Parse Server has a file upload Content-Type override via extension mismatch (CVSS 2.1)
- [CVE-2026-34784](https://cve.now/CVE-2026-34784.md): Parse Server: Streaming file download bypasses afterFind file trigger authorization (CVSS 8.2)
- [CVE-2026-34215](https://cve.now/CVE-2026-34215.md): Parse Server: Auth data exposed via verify password endpoint (CVSS 8.2)
- [CVE-2026-34595](https://cve.now/CVE-2026-34595.md): Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value (CVSS 5.3)
- [CVE-2026-34574](https://cve.now/CVE-2026-34574.md): Parse Server: Session field immutability bypass via falsy-value guard (CVSS 5.3)
- [CVE-2026-34573](https://cve.now/CVE-2026-34573.md): Parse Server: GraphQL complexity validator exponential fragment traversal DoS (CVSS 8.2)
- [CVE-2026-34532](https://cve.now/CVE-2026-34532.md): Parse Server: Cloud function validator bypass via prototype chain traversal (CVSS 9.1)
- [CVE-2026-34373](https://cve.now/CVE-2026-34373.md): Parse Server: GraphQL API endpoint ignores CORS origin restriction (CVSS 5.3)
- [CVE-2026-34363](https://cve.now/CVE-2026-34363.md): Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers (CVSS 8.2)
- [CVE-2026-34224](https://cve.now/CVE-2026-34224.md): Parse Server: MFA single-use token bypass via concurrent authData login requests (CVSS 2.1)
- [CVE-2026-33627](https://cve.now/CVE-2026-33627.md): Parse Server: Auth data exposed via /users/me endpoint (CVSS 7.1)
- [CVE-2026-33624](https://cve.now/CVE-2026-33624.md): Parse Server: MFA recovery code single-use bypass via concurrent requests (CVSS 2.1)
- [CVE-2026-33539](https://cve.now/CVE-2026-33539.md): Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter (CVSS 8.6)
- [CVE-2026-33538](https://cve.now/CVE-2026-33538.md): Parse Server: Denial of service via unindexed database query for unconfigured auth providers (CVSS 8.7)
- [CVE-2026-33527](https://cve.now/CVE-2026-33527.md): Parse Server: Session update endpoint allows overwriting server-generated session fields (CVSS 5.3)
- [CVE-2026-33508](https://cve.now/CVE-2026-33508.md): Parse Server: LiveQuery subscription query depth bypass (CVSS 8.2)
- [CVE-2026-33498](https://cve.now/CVE-2026-33498.md): Parse Server: Query condition depth bypass via pre-validation transform pipeline (CVSS 8.7)
- [CVE-2026-33429](https://cve.now/CVE-2026-33429.md): Parse Server: Protected field change detection oracle via LiveQuery watch parameter (CVSS 6.3)
- [CVE-2026-33421](https://cve.now/CVE-2026-33421.md): Parse Server: LiveQuery bypasses CLP pointer permission enforcement (CVSS 7.1)
- [CVE-2026-33409](https://cve.now/CVE-2026-33409.md): Parse Server: Auth provider validation bypass on login via partial authData (CVSS 7.0)
- [CVE-2026-33323](https://cve.now/CVE-2026-33323.md): Parse Server: Email verification resend page leaks user existence (CVSS 6.3)
- [CVE-2026-33163](https://cve.now/CVE-2026-33163.md): Parse Server leaks protected fields via LiveQuery afterEvent trigger (CVSS 8.2)
- [CVE-2026-33042](https://cve.now/CVE-2026-33042.md): Parse Server affected by empty authData bypassing credential requirement on signup (CVSS 6.9)
- [CVE-2026-32944](https://cve.now/CVE-2026-32944.md): Parse Server crash via deeply nested query condition operators (CVSS 8.7)
- [CVE-2026-32943](https://cve.now/CVE-2026-32943.md): Parse Server has a password reset token single-use bypass via concurrent requests (CVSS 2.3)
- [CVE-2026-32886](https://cve.now/CVE-2026-32886.md): Parse Server's Cloud function dispatch crashes server via prototype chain traversal (CVSS 8.2)
- [CVE-2026-32878](https://cve.now/CVE-2026-32878.md): Parse Server vulnerable to schema poisoning via prototype pollution in deep copy (CVSS 5.3)
- [CVE-2026-32770](https://cve.now/CVE-2026-32770.md): Parse Server: LiveQuery subscription with invalid regular expression crashes server (CVSS 5.9)
- [CVE-2026-32742](https://cve.now/CVE-2026-32742.md): Parse Server session creation endpoint allows overwriting server-generated session fields (CVSS 4.3)
- [CVE-2026-32728](https://cve.now/CVE-2026-32728.md): Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries (CVSS 8.3)
- [CVE-2026-32594](https://cve.now/CVE-2026-32594.md): Parse Server GraphQL WebSocket endpoint bypasses security middleware (CVSS 6.9)
- [CVE-2026-32269](https://cve.now/CVE-2026-32269.md): Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint (CVSS 6.3)
- [CVE-2026-32248](https://cve.now/CVE-2026-32248.md): Parse Server: Account takeover via operator injection in authentication data identifier (CVSS 9.3)
- [CVE-2026-32242](https://cve.now/CVE-2026-32242.md): Parse Server OAuth2 adapter shares mutable state across providers via singleton instance (CVSS 9.1)
- [CVE-2026-32234](https://cve.now/CVE-2026-32234.md): Parse Server has a SQL injection via query field name when using PostgreSQL (CVSS 5.1)
- [CVE-2026-32098](https://cve.now/CVE-2026-32098.md): Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause (CVSS 6.9)
- [CVE-2026-31901](https://cve.now/CVE-2026-31901.md): Parse Server has user enumeration via email verification endpoint (CVSS 6.3)
- [CVE-2026-31875](https://cve.now/CVE-2026-31875.md): Parse Server MFA recovery codes not consumed after use (CVSS 8.2)
- [CVE-2026-31872](https://cve.now/CVE-2026-31872.md): Parse Server has a protected fields bypass via dot-notation in query and sort (CVSS 8.7)
- [CVE-2026-31871](https://cve.now/CVE-2026-31871.md): Parse Server has a SQL Injection via dot-notation sub-key name in \`Increment\` operation on PostgreSQL (CVSS 9.3)
- [CVE-2026-31868](https://cve.now/CVE-2026-31868.md): Parse Server has Stored XSS via file upload of HTML-renderable file types (CVSS 6.3)
- [CVE-2026-31856](https://cve.now/CVE-2026-31856.md): Parse Server has a SQL injection via \`Increment\` operation on nested object field in PostgreSQL (CVSS 9.3)
- [CVE-2026-31840](https://cve.now/CVE-2026-31840.md): Parse Server has a SQL injection via dot-notation field name in PostgreSQL (CVSS 9.3)
- [CVE-2026-31828](https://cve.now/CVE-2026-31828.md): Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction (CVSS 6.0)
- [CVE-2026-31800](https://cve.now/CVE-2026-31800.md): Parse Server: Classes \`\_GraphQLConfig\` and \`\_Audience\` master key bypass via generic class routes (CVSS 8.8)
- [CVE-2026-30972](https://cve.now/CVE-2026-30972.md): Parse Server has a rate limit bypass via batch request endpoint (CVSS 6.9)
- [CVE-2026-30967](https://cve.now/CVE-2026-30967.md): Parse Server OAuth2 authentication adapter account takeover via identity spoofing (CVSS 7.6)
- [CVE-2026-30966](https://cve.now/CVE-2026-30966.md): Parse Server role escalation and CLP bypass via direct \`\_Join\` table write (CVSS 10.0)
- [CVE-2026-30965](https://cve.now/CVE-2026-30965.md): Parse Server session token exfiltration via \`redirectClassNameForKey\` query parameter (CVSS 9.9)
- [CVE-2026-30962](https://cve.now/CVE-2026-30962.md): Parse Server has a protected fields bypass via logical query operators (CVSS 7.1)
- [CVE-2026-30949](https://cve.now/CVE-2026-30949.md): Parse Server is missing audience validation in Keycloak authentication adapter (CVSS 7.6)
- [CVE-2026-30948](https://cve.now/CVE-2026-30948.md): Parse Server has stored cross-site scripting (XSS) via SVG file upload (CVSS 8.3)
- [CVE-2026-30947](https://cve.now/CVE-2026-30947.md): Parse Server ha a bypass of class-level permissions in LiveQuery (CVSS 8.7)
- [CVE-2026-30946](https://cve.now/CVE-2026-30946.md): Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API (CVSS 8.7)
- [CVE-2026-30941](https://cve.now/CVE-2026-30941.md): Parse Server has a NoSQL injection via token type in password reset and email verification endpoints (CVSS 8.7)
- [CVE-2026-30939](https://cve.now/CVE-2026-30939.md): Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution (CVSS 8.8)
- [CVE-2026-30938](https://cve.now/CVE-2026-30938.md): Parse Server has denylist \`requestKeywordDenylist\` keyword scan bypass through nested object placement (CVSS 6.9)
- [CVE-2026-30925](https://cve.now/CVE-2026-30925.md): Parse Server affected by Regular Expression Denial of Service (ReDoS) via \`$regex\` query in LiveQuery (CVSS 8.2)
- [CVE-2026-30854](https://cve.now/CVE-2026-30854.md): Parse Server: GraphQL \`\_\_type\` introspection bypass via inline fragments when public introspection is disabled (CVSS 6.9)
- [CVE-2026-30850](https://cve.now/CVE-2026-30850.md): Parse Server: File metadata endpoint bypasses \`beforeFind\` / \`afterFind\` trigger authorization (CVSS 6.3)
- [CVE-2026-30848](https://cve.now/CVE-2026-30848.md): Parse Server: \`PagesRouter\` path traversal allows reading files outside configured pages directory (CVSS 6.3)
- [CVE-2026-30863](https://cve.now/CVE-2026-30863.md): Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters (CVSS 9.3)
- [CVE-2026-30835](https://cve.now/CVE-2026-30835.md): Parse Server: Malformed \`$regex\` query leaks database error details in API response (CVSS 6.9)
- [CVE-2026-30229](https://cve.now/CVE-2026-30229.md): Parse Server: Endpoint \`/loginAs\` allows \`readOnlyMasterKey\` to gain full read and write access as any user (CVSS 8.5)
- [CVE-2026-30228](https://cve.now/CVE-2026-30228.md): Parse Server: File creation and deletion bypasses \`readOnlyMasterKey\` write restriction (CVSS 6.9)
- [CVE-2026-29182](https://cve.now/CVE-2026-29182.md): Parse Server: Cloud Hooks and Cloud Jobs bypass \`readOnlyMasterKey\` write restriction (CVSS 8.6)
- [CVE-2026-27804](https://cve.now/CVE-2026-27804.md): Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter (CVSS 9.3)
- [CVE-2026-27595](https://cve.now/CVE-2026-27595.md): Parse Dashboard has incomplete authentication on AI Agent endpoint (CVSS 9.9)
- [CVE-2026-27610](https://cve.now/CVE-2026-27610.md): Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions (CVSS 7.0)
- [CVE-2026-27609](https://cve.now/CVE-2026-27609.md): Parse Dashboard Missing CSRF Protection on Agent Endpoint (CVSS 8.3)
- [CVE-2026-27608](https://cve.now/CVE-2026-27608.md): Parse Dashboard Missing Authorization on Agent Endpoint (CVSS 9.3)
- [CVE-2025-68150](https://cve.now/CVE-2025-68150.md): Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter (CVSS 8.3)
- [CVE-2025-68115](https://cve.now/CVE-2025-68115.md): Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables (CVSS 5.3)
- [CVE-2025-67727](https://cve.now/CVE-2025-67727.md): Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management (CVSS 6.9)
- [CVE-2025-64502](https://cve.now/CVE-2025-64502.md): Parse Server allows public \`explain\` queries which may expose sensitive database performance information and schema details (CVSS 6.9)
- [CVE-2025-64430](https://cve.now/CVE-2025-64430.md): Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format (CVSS 7.5)
- [CVE-2025-62374](https://cve.now/CVE-2025-62374.md): Parse Javascript SDK vulnerable to prototype pollution in \`Parse.Object\` and internal APIs (CVSS 6.4)
- [CVE-2025-53364](https://cve.now/CVE-2025-53364.md): Parse Server exposes the data schema via GraphQL API (CVSS 5.3)
- [CVE-2025-30168](https://cve.now/CVE-2025-30168.md): Parse Server has an OAuth login vulnerability (CVSS 6.9)
- [CVE-2024-47183](https://cve.now/CVE-2024-47183.md): Parse Server's custom object ID allows to acquire role privileges (CVSS 8.1)
- [CVE-2024-39309](https://cve.now/CVE-2024-39309.md): ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability (CVSS 9.8)
- [CVE-2024-29027](https://cve.now/CVE-2024-29027.md): Parse Server crash and RCE via invalid Cloud Function or Cloud Job name (CVSS 9.1)
- [CVE-2024-27298](https://cve.now/CVE-2024-27298.md): Parse Server literalizeRegexPart SQL Injection (CVSS 10.0)
- [CVE-2023-46119](https://cve.now/CVE-2023-46119.md): Parse Server may crash when uploading file without extension (CVSS 7.5)
- [CVE-2023-41058](https://cve.now/CVE-2023-41058.md): Trigger \`beforeFind\` not invoked in internal query pipeline in parse-server (CVSS 7.5)
- [CVE-2023-36475](https://cve.now/CVE-2023-36475.md): Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution (CVSS 9.8)
- [CVE-2023-32689](https://cve.now/CVE-2023-32689.md): Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file (CVSS 6.3)
- [CVE-2023-32688](https://cve.now/CVE-2023-32688.md): Invalid push request payload crashes Parse Server (CVSS 4.9)
- [CVE-2023-22474](https://cve.now/CVE-2023-22474.md): Parse Server is vulnerable to authentication bypass via spoofing (CVSS 8.7)
- [CVE-2022-41879](https://cve.now/CVE-2022-41879.md): Parse Server subject to Prototype pollution via Cloud Code Webhooks (CVSS 7.2)
- [CVE-2022-41878](https://cve.now/CVE-2022-41878.md): Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers (CVSS 7.2)
- [CVE-2022-39396](https://cve.now/CVE-2022-39396.md): Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser (CVSS 9.8)
- [CVE-2022-39313](https://cve.now/CVE-2022-39313.md): Parse Server crashes when receiving file download request with invalid byte range (CVSS 7.5)
- [CVE-2022-39231](https://cve.now/CVE-2022-39231.md): Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented (CVSS 3.7)
- [CVE-2022-39225](https://cve.now/CVE-2022-39225.md): Parse Server subject to Incorrect Resource Transfer Between Spheres (CVSS 4.3)
- [CVE-2022-36079](https://cve.now/CVE-2022-36079.md): Parse Server vulnerable to brute force guessing of user sensitive data via search patterns (CVSS 8.6)
- [CVE-2022-31112](https://cve.now/CVE-2022-31112.md): Protected fields exposed via LiveQuery in parse-server (CVSS 8.2)
- [CVE-2022-31089](https://cve.now/CVE-2022-31089.md): Invalid file request can crashe parse-server (CVSS 7.5)
- [CVE-2022-31083](https://cve.now/CVE-2022-31083.md): Authentication bypass in Parse Server Apple Game Center auth adapter (CVSS 8.6)
- [CVE-2022-24901](https://cve.now/CVE-2022-24901.md): Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (CVSS 7.5)
- [CVE-2022-24760](https://cve.now/CVE-2022-24760.md): Command Injection in Parse server (CVSS 10.0)
- [CVE-2021-41109](https://cve.now/CVE-2021-41109.md): LiveQuery publishes user session tokens (CVSS 7.5)
- [CVE-2021-39187](https://cve.now/CVE-2021-39187.md): Crash server with query parameter (CVSS 7.5)
- [CVE-2021-39138](https://cve.now/CVE-2021-39138.md): New anonymous user session acts as if it's created with password (CVSS 4.8)
- [CVE-2020-26288](https://cve.now/CVE-2020-26288.md): Parse Server stores password in plain text (CVSS 7.7)
- [CVE-2020-15270](https://cve.now/CVE-2020-15270.md): Improper session expiration in Parse Server (CVSS 4.3)
- [CVE-2020-15126](https://cve.now/CVE-2020-15126.md): Information disclosure through Viewer query in parse-server (CVSS 6.5)
- [CVE-2020-5251](https://cve.now/CVE-2020-5251.md): Information disclosure in parse-server (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/parse-community
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.