What’s Vulnerable › Products
parse-community parse-server vulnerabilities
138 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 110 published in the last 12 months.
Check whether your parse-community parse-server version is affected
Latest parse-community parse-server vulnerabilities
- CVE-2026-116801 — Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query (CVSS 4.3)
- CVE-2026-116165 — Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB (CVSS 8.8)
- CVE-2026-116164 — Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes (CVSS 6.3)
- CVE-2026-116162 — Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login (CVSS 2.1)
- CVE-2026-116161 — Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions (CVSS 6.0)
- CVE-2026-116163 — Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses (CVSS 7.4)
- CVE-2026-112769 — Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass (CVSS 2.3)
- CVE-2026-112768 — Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update (CVSS 6.9)
- CVE-2026-110854 — Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error (CVSS 8.2)
- CVE-2026-109954 — Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference (CVSS 6.5)
- CVE-2026-109303 — Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query (CVSS 4.3)
- CVE-2026-109302 — Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries (CVSS 3.7)
- CVE-2026-109301 — Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL (CVSS 5.9)
- CVE-2026-105828 — Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors (CVSS 6.3)
- CVE-2026-101042 — Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity (CVSS 6.4)
- CVE-2026-100632 — Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery (CVSS 6.5)
- CVE-2026-100631 — Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection (CVSS 7.5)
- CVE-2026-87806 — Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password (CVSS 7.4)
- CVE-2026-66009 — Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (CVSS 6.3)
- CVE-2026-66008 — Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (CVSS 6.3)
- CVE-2026-64627 — Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion (CVSS 6.9)
- CVE-2026-61448 — Parse Server 9.0.0 Stored XSS via malformed Content-Type (CVSS 2.1)
- CVE-2026-57481 — Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change (CVSS 2.3)
- CVE-2026-57480 — Parse Server: Denial of service via exponential-time processing of deeply nested query operators (CVSS 8.7)
- CVE-2026-55778 — Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist (CVSS 2.1)