Parse-community vulnerabilities
157 CVEs and advisories name Parse-community as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
- CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Type
- CVE-2026-57481Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
- CVE-2026-57480Parse Server: Denial of service via exponential-time processing of deeply nested query operators
- CVE-2026-55778Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
- CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tags
- CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tags
- CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
- CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
- CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
- CVE-2026-50008Parse Server: Server option routeAllowList is bypassable through batch sub-requests
- CVE-2026-47138Parse Server: Pre-authentication denial of service via client version header regex backtracking
- CVE-2026-47248Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers
- CVE-2026-43930Parse Server: MFA SMS one-time password accepted twice under concurrent login
- CVE-2026-39381Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
- CVE-2026-39321Parse Server has a login timing side-channel reveals user existence
- CVE-2026-35200Parse Server has a file upload Content-Type override via extension mismatch
- CVE-2026-34784Parse Server: Streaming file download bypasses afterFind file trigger authorization
- CVE-2026-34215Parse Server: Auth data exposed via verify password endpoint
- CVE-2026-34595Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value
- CVE-2026-34574Parse Server: Session field immutability bypass via falsy-value guard
- CVE-2026-34573Parse Server: GraphQL complexity validator exponential fragment traversal DoS
- CVE-2026-34532Parse Server: Cloud function validator bypass via prototype chain traversal
- CVE-2026-34373Parse Server: GraphQL API endpoint ignores CORS origin restriction
- CVE-2026-34363Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers
- CVE-2026-34224Parse Server: MFA single-use token bypass via concurrent authData login requests
- CVE-2026-33627Parse Server: Auth data exposed via /users/me endpoint