Parse-community vulnerabilities
157 CVEs and advisories name Parse-community as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-31856Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
- CVE-2026-31840Parse Server has a SQL injection via dot-notation field name in PostgreSQL
- CVE-2026-31828Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction
- CVE-2026-31800Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
- CVE-2026-30972Parse Server has a rate limit bypass via batch request endpoint
- CVE-2026-30967Parse Server OAuth2 authentication adapter account takeover via identity spoofing
- CVE-2026-30966Parse Server role escalation and CLP bypass via direct `_Join` table write
- CVE-2026-30965Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
- CVE-2026-30962Parse Server has a protected fields bypass via logical query operators
- CVE-2026-30949Parse Server is missing audience validation in Keycloak authentication adapter
- CVE-2026-30948Parse Server has stored cross-site scripting (XSS) via SVG file upload
- CVE-2026-30947Parse Server ha a bypass of class-level permissions in LiveQuery
- CVE-2026-30946Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
- CVE-2026-30941Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
- CVE-2026-30939Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
- CVE-2026-30938Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
- CVE-2026-30925Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
- CVE-2026-30854Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
- CVE-2026-30850Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
- CVE-2026-30848Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
- CVE-2026-30863Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
- CVE-2026-30835Parse Server: Malformed `$regex` query leaks database error details in API response
- CVE-2026-30229Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
- CVE-2026-30228Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction
- CVE-2026-29182Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
- CVE-2026-27804Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
- CVE-2026-27595Parse Dashboard has incomplete authentication on AI Agent endpoint
- CVE-2026-27610Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
- CVE-2026-27609Parse Dashboard Missing CSRF Protection on Agent Endpoint
- CVE-2026-27608Parse Dashboard Missing Authorization on Agent Endpoint