Parse-community vulnerabilities
157 CVEs and advisories name Parse-community as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33624Parse Server: MFA recovery code single-use bypass via concurrent requests
- CVE-2026-33539Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
- CVE-2026-33538Parse Server: Denial of service via unindexed database query for unconfigured auth providers
- CVE-2026-33527Parse Server: Session update endpoint allows overwriting server-generated session fields
- CVE-2026-33508Parse Server: LiveQuery subscription query depth bypass
- CVE-2026-33498Parse Server: Query condition depth bypass via pre-validation transform pipeline
- CVE-2026-33429Parse Server: Protected field change detection oracle via LiveQuery watch parameter
- CVE-2026-33421Parse Server: LiveQuery bypasses CLP pointer permission enforcement
- CVE-2026-33409Parse Server: Auth provider validation bypass on login via partial authData
- CVE-2026-33323Parse Server: Email verification resend page leaks user existence
- CVE-2026-33163Parse Server leaks protected fields via LiveQuery afterEvent trigger
- CVE-2026-33042Parse Server affected by empty authData bypassing credential requirement on signup
- CVE-2026-32944Parse Server crash via deeply nested query condition operators
- CVE-2026-32943Parse Server has a password reset token single-use bypass via concurrent requests
- CVE-2026-32886Parse Server's Cloud function dispatch crashes server via prototype chain traversal
- CVE-2026-32878Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
- CVE-2026-32770Parse Server: LiveQuery subscription with invalid regular expression crashes server
- CVE-2026-32742Parse Server session creation endpoint allows overwriting server-generated session fields
- CVE-2026-32728Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
- CVE-2026-32594Parse Server GraphQL WebSocket endpoint bypasses security middleware
- CVE-2026-32269Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
- CVE-2026-32248Parse Server: Account takeover via operator injection in authentication data identifier
- CVE-2026-32242Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
- CVE-2026-32234Parse Server has a SQL injection via query field name when using PostgreSQL
- CVE-2026-32098Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause
- CVE-2026-31901Parse Server has user enumeration via email verification endpoint
- CVE-2026-31875Parse Server MFA recovery codes not consumed after use
- CVE-2026-31872Parse Server has a protected fields bypass via dot-notation in query and sort
- CVE-2026-31871Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
- CVE-2026-31868Parse Server has Stored XSS via file upload of HTML-renderable file types