parse-community parse-server
138 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-116801 | 9.0.0 – < 9.10.5-alpha.6 | Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-116165 | 9.0.0 – < 9.10.4-alpha.4 | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB | HIGH 8.8 | 0.3 % | ||
| CVE-2026-116164 | 9.0.0 – < 9.10.4-alpha.3 | Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-116163 | 9.0.0 – < 9.10.5-alpha.2 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-116162 | 9.0.0 – < 9.10.5-alpha.5 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login | LOW 2.1 | 0.4 % | ||
| CVE-2026-116161 | 9.0.0 – < 9.10.5-alpha.4 | Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-112769 | 9.0.0 – < 9.10.3-alpha.1 | Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass | LOW 2.3 | 0.3 % | ||
| CVE-2026-112768 | 9.0.0 – < 9.10.3-alpha.2 | Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-110854 | < 8.6.97 ; 9.0.0 – < 9.10.2-alpha.6 | Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error | HIGH 8.2 | 0.3 % | ||
| CVE-2026-109954 | 9.0.0 – < 9.10.2-alpha.5 | Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference | HIGH 8.3 | 0.2 % | ||
| CVE-2026-109303 | 9.0.0 – < 9.10.1-alpha.13 | Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-109302 | 9.0.0 – < 9.10.1-alpha.14 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-109301 | 9.0.0 – < 9.10.2-alpha.3 | Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL | HIGH 8.2 | 0.3 % | ||
| CVE-2026-105828 | 9.0.0 – < 9.10.1-alpha.12 | Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-101042 | 9.0.0 – < 9.10.1-alpha.10 | Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity | HIGH 7.4 | 0.2 % | ||
| CVE-2026-100632 | 9.0.0 – < 9.10.1-alpha.8 | Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery | HIGH 7.1 | 0.3 % | ||
| CVE-2026-100631 | 9.0.0 – < 9.10.1-alpha.9 | Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection | HIGH 8.7 | 0.4 % | ||
| CVE-2026-87806 | 9.0.0 – < 9.10.1-alpha.7 | Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-66009 | 9.0.0 – < 9.10.0-alpha.5 | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-66008 | 9.0.0 – < 9.10.0-alpha.6 | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages | MEDIUM 6.3 | 0.6 % | ||
| CVE-2026-64627 | 9.0.0 – < 9.10.0-alpha.4 | Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-61448 | 9.0.0 – < 9.10.0-alpha.2 | Parse Server 9.0.0 Stored XSS via malformed Content-Type | LOW 2.1 | 0.4 % | ||
| CVE-2026-57481 | >= 9.0.0-alpha.1, < 9.9.1-alpha.13 ; < 8.6.83 | Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change | LOW 2.3 | 0.5 % | ||
| CVE-2026-57480 | >= 9.0.0-alpha.1, < 9.9.1-alpha.12 ; < 8.6.82 | Parse Server: Denial of service via exponential-time processing of deeply nested query operators | HIGH 8.7 | 0.6 % | ||
| CVE-2026-55778 | >= 9.0.0-alpha.1, < 9.9.1-alpha.11 ; < 8.6.81 | Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist | LOW 2.1 | 0.6 % | ||
| CVE-2021-47987 | < 4.10.0 | Parse Server - Arbitrary Code Execution via Malicious Version Tags | HIGH 7.7 | 0.2 % | ||
| CVE-2021-47986 | < 4.10.0 | Parse Server - Unreviewed Code Execution via Malicious Version Tags | HIGH 7.7 | 0.2 % | ||
| CVE-2026-53726 | < 8.6.80 ; >= 9.0.0, < 9.9.1-alpha.6 | Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-53725 | >= 9.8.0, < 9.9.1-alpha.5 | Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-53724 | < 8.6.79 ; >= 9.0.0, < 9.9.1-alpha.4 | Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist | LOW 2.1 | 0.3 % | ||
| CVE-2026-50008 | >= 9.8.0, < 9.9.1-alpha.3 | Parse Server: Server option routeAllowList is bypassable through batch sub-requests | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-47138 | < 8.6.77 ; >= 9.0.0, < 9.9.1-alpha.1 | Parse Server: Pre-authentication denial of service via client version header regex backtracking | HIGH 8.7 | 0.6 % | ||
| CVE-2026-47248 | < 8.6.78 ; >= 9.0.0, < 9.9.1-alpha.2 | Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-43930 | >= 9.0.0, < 9.9.0-alpha.2 ; < 8.6.76 | Parse Server: MFA SMS one-time password accepted twice under concurrent login | LOW 2.1 | 0.2 % | ||
| CVE-2026-39381 | >= 9.0.0, < 9.8.0-alpha.7 ; >= 7.0.0, < 8.6.75 | Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-39321 | >= 9.0.0, < 9.8.0-alpha.6 ; < 8.6.74 | Parse Server has a login timing side-channel reveals user existence | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-35200 | >= 9.0.0, < 9.7.1-alpha.4 ; < 8.6.73 | Parse Server has a file upload Content-Type override via extension mismatch | LOW 2.1 | 0.2 % | ||
| CVE-2026-34784 | < 8.6.71 ; >= 9.0.0, < 9.7.1-alpha.1 | Parse Server: Streaming file download bypasses afterFind file trigger authorization | HIGH 8.2 | 0.4 % | ||
| CVE-2026-34215 | < 8.6.63 ; >= 9.0.0, < 9.7.0-alpha.7 | Parse Server: Auth data exposed via verify password endpoint | HIGH 8.2 | 0.3 % | ||
| CVE-2026-34595 | < 8.6.70 ; >= 9.0.0, < 9.7.0-alpha.18 | Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-34574 | < 8.6.69 ; >= 9.0.0, < 9.7.0-alpha.14 | Parse Server: Session field immutability bypass via falsy-value guard | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-34573 | < 8.6.68 ; >= 9.0.0, < 9.7.0-alpha.12 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS | HIGH 8.2 | 0.6 % | ||
| CVE-2026-34532 | < 8.6.67 ; >= 9.0.0, < 9.7.0-alpha.11 | Parse Server: Cloud function validator bypass via prototype chain traversal | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-34373 | < 8.6.66 ; >= 9.0.0, < 9.7.0-alpha.10 | Parse Server: GraphQL API endpoint ignores CORS origin restriction | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-34363 | < 8.6.65 ; >= 9.0.0, < 9.7.0-alpha.9 | Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers | HIGH 8.2 | 0.4 % | ||
| CVE-2026-34224 | < 8.6.64 ; >= 9.0.0, < 9.7.0-alpha.8 | Parse Server: MFA single-use token bypass via concurrent authData login requests | LOW 2.1 | 0.3 % | ||
| CVE-2026-33627 | < 8.6.61 ; >= 9.0.0, < 9.6.0-alpha.55 | Parse Server: Auth data exposed via /users/me endpoint | HIGH 7.1 | 0.4 % | ||
| CVE-2026-33624 | < 8.6.60 ; >= 9.0.0, < 9.6.0-alpha.54 | Parse Server: MFA recovery code single-use bypass via concurrent requests | LOW 2.1 | 0.2 % | ||
| CVE-2026-33539 | < 8.6.59 ; >= 9.0.0, < 9.6.0-alpha.53 | Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter | HIGH 8.6 | 0.5 % | ||
| CVE-2026-33538 | < 8.6.58 ; >= 9.0.0, < 9.6.0-alpha.52 | Parse Server: Denial of service via unindexed database query for unconfigured auth providers | HIGH 8.7 | 0.4 % | ||
| CVE-2026-33527 | < 8.6.57 ; >= 9.0.0, < 9.6.0-alpha.48 | Parse Server: Session update endpoint allows overwriting server-generated session fields | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-33508 | < 8.6.56 ; >= 9.0.0, < 9.6.0-alpha.45 | Parse Server: LiveQuery subscription query depth bypass | HIGH 8.2 | 0.4 % | ||
| CVE-2026-33498 | < 8.6.55 ; >= 9.0.0, < 9.6.0-alpha.44 | Parse Server: Query condition depth bypass via pre-validation transform pipeline | HIGH 8.7 | 0.5 % | ||
| CVE-2026-33429 | < 8.6.54 ; >= 9.0.0, < 9.6.0-alpha.43 | Parse Server: Protected field change detection oracle via LiveQuery watch parameter | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-33421 | < 8.6.53 ; >= 9.0.0, < 9.6.0-alpha.42 | Parse Server: LiveQuery bypasses CLP pointer permission enforcement | HIGH 7.1 | 0.4 % | ||
| CVE-2026-33409 | < 8.6.52 ; >= 9.0.0, < 9.6.0-alpha.41 | Parse Server: Auth provider validation bypass on login via partial authData | HIGH 7.0 | 0.5 % | ||
| CVE-2026-33323 | < 8.6.51 ; >= 9.0.0, < 9.6.0-alpha.40 | Parse Server: Email verification resend page leaks user existence | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-33163 | >= 9.0.0, < 9.6.0-alpha.35 ; < 8.6.50 | Parse Server leaks protected fields via LiveQuery afterEvent trigger | HIGH 8.2 | 0.4 % | ||
| CVE-2026-33042 | >= 9.0.0, < 9.6.0-alpha.29 ; < 8.6.49 | Parse Server affected by empty authData bypassing credential requirement on signup | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-32944 | >= 9.0.0, < 9.6.0-alpha.21 ; < 8.6.45 | Parse Server crash via deeply nested query condition operators | HIGH 8.7 | 0.5 % | ||
| CVE-2026-32943 | >= 9.0.0, < 9.6.0-alpha.28 ; < 8.6.48 | Parse Server has a password reset token single-use bypass via concurrent requests | LOW 2.3 | 0.2 % | ||
| CVE-2026-32886 | >= 9.0.0, < 9.6.0-alpha.24 ; < 8.6.47 | Parse Server's Cloud function dispatch crashes server via prototype chain traversal | HIGH 8.2 | 0.5 % | ||
| CVE-2026-32878 | >= 9.0.0, < 9.6.0-alpha.20 ; < 8.6.44 | Parse Server vulnerable to schema poisoning via prototype pollution in deep copy | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-32770 | >= 9.0.0, < 9.6.0-alpha.19 ; < 8.6.43 | Parse Server: LiveQuery subscription with invalid regular expression crashes server | HIGH 7.5 | 0.6 % | ||
| CVE-2026-32742 | >= 9.0.0, < 9.6.0-alpha.17 ; < 8.6.42 | Parse Server session creation endpoint allows overwriting server-generated session fields | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-32728 | >= 9.0.0, < 9.6.0-alpha.15 ; < 8.6.41 | Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries | HIGH 8.3 | 0.3 % | ||
| CVE-2026-32594 | >= 9.0.0 < 9.6.0-alpha.14 ; < 8.6.40 | Parse Server GraphQL WebSocket endpoint bypasses security middleware | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-32269 | >= 9.0.0, < 9.6.0-alpha.13 ; >= 8.0.2, < 8.6.39 | Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-32248 | >= 9.0.0, < 9.6.0-alpha.12 ; < 8.6.38 | Parse Server: Account takeover via operator injection in authentication data identifier | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-32242 | >= 9.0.0 < 9.6.0-alpha.11 ; < 8.6.37 | Parse Server OAuth2 adapter shares mutable state across providers via singleton instance | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-32234 | >= 9.0.0 < 9.6.0-alpha.10 ; < 8.6.36 | Parse Server has a SQL injection via query field name when using PostgreSQL | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-32098 | >= 9.0.0 < 9.6.0-alpha.9 ; < 8.6.35 | Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-31901 | >= 9.0.0 < 9.6.0-alpha.8 ; < 8.6.34 | Parse Server has user enumeration via email verification endpoint | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-31875 | >= 9.0.0 < 9.6.0-alpha.7 ; < 8.6.33 | Parse Server MFA recovery codes not consumed after use | HIGH 8.2 | 0.5 % | ||
| CVE-2026-31872 | >= 9.0.0 < 9.6.0-alpha.6 ; < 8.6.32 | Parse Server has a protected fields bypass via dot-notation in query and sort | HIGH 8.7 | 0.4 % | ||
| CVE-2026-31871 | >= 9.0.0 < 9.6.0-alpha.5 ; < 8.6.31 | Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-31868 | >= 9.0.0 < 9.6.0-alpha.4 ; < 8.6.30 | Parse Server has Stored XSS via file upload of HTML-renderable file types | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-31856 | >= 9.0.0 < 9.6.0-alpha.3 ; < 8.6.29 | Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-31840 | >= 9.0.0 < 9.6.0-alpha.2 ; < 8.6.28 | Parse Server has a SQL injection via dot-notation field name in PostgreSQL | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-31828 | >= 9.0.0 < 9.5.2-alpha.13 ; < 8.6.26 | Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-31800 | >= 9.0.0 < 9.5.2-alpha.12 ; < 8.6.25 | Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes | HIGH 8.8 | 0.3 % | ||
| CVE-2026-30972 | >= 9.0.0 < 9.5.2-alpha.10 ; < 8.6.23 | Parse Server has a rate limit bypass via batch request endpoint | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-30967 | >= 9.0.0 < 9.5.2-alpha.9 ; < 8.6.22 | Parse Server OAuth2 authentication adapter account takeover via identity spoofing | HIGH 7.6 | 0.4 % | ||
| CVE-2026-30966 | >= 9.0.0 < 9.5.2-alpha.7 ; < 8.6.20 | Parse Server role escalation and CLP bypass via direct `_Join` table write | CRITICAL 10.0 | 0.4 % | ||
| CVE-2026-30965 | >= 9.0.0 < 9.5.2-alpha.8 ; < 8.6.21 | Parse Server session token exfiltration via `redirectClassNameForKey` query parameter | CRITICAL 9.9 | 1.4 % | ||
| CVE-2026-30962 | >= 9.0.0 < 9.5.2-alpha.6 ; < 8.6.19 | Parse Server has a protected fields bypass via logical query operators | HIGH 7.1 | 0.3 % | ||
| CVE-2026-30949 | >= 9.0.0 < 9.5.2-alpha.5 ; < 8.6.18 | Parse Server is missing audience validation in Keycloak authentication adapter | HIGH 7.6 | 0.5 % | ||
| CVE-2026-30948 | >= 9.0.0 < 9.5.2-alpha.4 ; < 8.6.17 | Parse Server has stored cross-site scripting (XSS) via SVG file upload | HIGH 8.3 | 0.2 % | ||
| CVE-2026-30947 | >= 9.0.0 < 9.5.2-alpha.3 ; < 8.6.16 | Parse Server ha a bypass of class-level permissions in LiveQuery | HIGH 8.7 | 0.4 % | ||
| CVE-2026-30946 | < 8.6.15 ; >= 9.0.0 < 9.5.2-alpha.2 | Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API | HIGH 8.7 | 0.6 % | ||
| CVE-2026-30941 | >= 9.0.0 < 9.5.2-alpha.1 ; < 8.6.14 | Parse Server has a NoSQL injection via token type in password reset and email verification endpoints | HIGH 8.7 | 0.5 % | ||
| CVE-2026-30939 | < 8.6.13 ; >= 9.0.0 < 9.5.1-alpha.2 | Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution | HIGH 8.8 | 0.5 % | ||
| CVE-2026-30938 | < 8.6.12 ; >= 9.0.0 < 9.5.1-alpha.1 | Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-30925 | >= 9.0.0 < 9.5.0-alpha.14 ; < 8.6.11 | Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery | HIGH 8.2 | 0.5 % | ||
| CVE-2026-30854 | >= 9.3.1-alpha.3, < 9.5.0-alpha.10 | Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-30850 | < 8.6.9 ; < 9.5.0-alpha.9 | Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-30848 | < 8.6.8 ; < 9.5.0-alpha.8 | Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-30863 | < 8.6.10 ; < 9.5.0-alpha.11 | Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-30835 | < 8.6.7 ; < 9.5.0-alpha.6 | Parse Server: Malformed `$regex` query leaks database error details in API response | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-30229 | < 8.6.6 ; < 9.5.0-alpha.4 | Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user | HIGH 8.5 | 0.4 % | ||
| CVE-2026-30228 | < 8.6.5 ; < 9.5.0-alpha.3 | Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-29182 | < 8.6.4 ; < 9.4.1-alpha.3 | Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction | HIGH 8.6 | 0.4 % | ||
| CVE-2026-27804 | >= 9.0.0, < 9.3.1-alpha.4 ; < 8.6.3 | Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter | CRITICAL 9.3 | 0.2 % | ||
| CVE-2025-68150 | < 8.6.2 ; >= 9.0.0, < 9.1.1-alpha.1 | Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter | HIGH 8.3 | 0.3 % | ||
| CVE-2025-68115 | < 8.6.1 ; >= 9.0.0, < 9.1.0-alpha.3 | Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-67727 | < 8.6.0-alpha.2 | Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management | MEDIUM 6.9 | 0.4 % | ||
| CVE-2025-64502 | < 8.5.0-alpha.5 | Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details | MEDIUM 6.9 | 0.4 % | ||
| CVE-2025-64430 | >= 4.2.0, < 7.5.4 ; >= 8.0.0, <= 8.4.0-alpha.1 | Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format | HIGH 7.5 | 0.6 % | ||
| CVE-2025-53364 | >= 5.3.0, < 7.5.3 ; >= 8.0.0, < 8.2.2 | Parse Server exposes the data schema via GraphQL API | MEDIUM 5.3 | 1.0 % | ||
| CVE-2025-30168 | < 7.5.2 ; >= 8.0.0 ,< 8.0.2 | Parse Server has an OAuth login vulnerability | MEDIUM 6.9 | 0.4 % | ||
| CVE-2024-47183 | < 6.5.9 ; >= 7.0.0, < 7.3.0 | Parse Server's custom object ID allows to acquire role privileges | HIGH 8.1 | 0.4 % | ||
| CVE-2024-39309 | < 6.5.7 ; >= 7.0.0, < 7.1.0 | ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability | CRITICAL 9.8 | 20 % | ||
| CVE-2024-29027 | < 6.5.5 ; >= 7.0.0-alpha.1, < 7.0.0-alpha.29 | Parse Server crash and RCE via invalid Cloud Function or Cloud Job name | CRITICAL 9.1 | 1.2 % | ||
| CVE-2024-27298 | < 6.5.0 ; >= 7.0.0-alpha.1, < 7.0.0-alpha.20 | Parse Server literalizeRegexPart SQL Injection | CRITICAL 10.0 | 1.0 % | ||
| CVE-2023-46119 | >= 1.0.0, < 5.5.6 ; >= 6.0.0, < 6.3.1 | Parse Server may crash when uploading file without extension | HIGH 7.5 | 1.3 % | ||
| CVE-2023-41058 | >= 1.0.0, < 5.5.5 ; >= 6.0.0, < 6.2.2 | Trigger `beforeFind` not invoked in internal query pipeline in parse-server | HIGH 7.5 | 0.8 % | ||
| CVE-2023-36475 | < 5.5.2 ; >= 6.0.0, < 6.2.1 | Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution | CRITICAL 9.8 | 3.2 % | ||
| CVE-2023-32689 | < 5.4.4 ; >= 6.0.0, < 6.1.1 | Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-22474 | < 5.4.1 | Parse Server is vulnerable to authentication bypass via spoofing | HIGH 8.7 | 0.7 % | ||
| CVE-2022-41879 | < 4.10.20 ; >= 5.0.0, < 5.3.3 | Parse Server subject to Prototype pollution via Cloud Code Webhooks | CRITICAL 9.8 | 0.9 % | ||
| CVE-2022-41878 | < 4.10.19 | Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers | CRITICAL 9.8 | 1.0 % | ||
| CVE-2022-39396 | < 4.10.18 ; >= 5.0.0, < 5.3.1 | Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser | CRITICAL 9.8 | 39 % | ||
| CVE-2022-39313 | < 4.10.17 ; >= 5.0.0, < 5.2.8 | Parse Server crashes when receiving file download request with invalid byte range | HIGH 7.5 | 0.8 % | ||
| CVE-2022-39231 | < 4.10.16 ; >= 5.0.0, < 5.2.7 | Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented | LOW 3.7 | 0.5 % | ||
| CVE-2022-39225 | < 4.10.15 ; >= 5.0.0, < 5.2.6 | Parse Server subject to Incorrect Resource Transfer Between Spheres | MEDIUM 4.3 | 0.5 % | ||
| CVE-2022-36079 | < 4.10.14 ; >= 5.0.0, < 5.2.5 | Parse Server vulnerable to brute force guessing of user sensitive data via search patterns | HIGH 8.6 | 1.3 % | ||
| CVE-2022-31112 | < 4.10.13 ; >= 5.0.0, < 5.2.4 | Protected fields exposed via LiveQuery in parse-server | HIGH 8.2 | 1.3 % | ||
| CVE-2022-31089 | < 4.10.12 ; >=5.0.0, < 5.2.3 | Invalid file request can crashe parse-server | HIGH 7.5 | 1.2 % | ||
| CVE-2022-31083 | < 4.0.11 ; >= 5.0.0, < 5.2.2 | Authentication bypass in Parse Server Apple Game Center auth adapter | HIGH 8.6 | 0.9 % | ||
| CVE-2022-24901 | < 4.10.10 ; >= 5.0.0, < 5.2.1 | Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter | HIGH 7.5 | 0.7 % | ||
| CVE-2022-24760 | < 4.10.7 | Command Injection in Parse server | CRITICAL 10.0 | 49 % | ||
| CVE-2021-41109 | < 4.10.4 | LiveQuery publishes user session tokens | HIGH 7.5 | 1.2 % | ||
| CVE-2021-39187 | < 4.10.3 | Crash server with query parameter | HIGH 7.5 | 1.8 % | ||
| CVE-2021-39138 | < 4.5.1 | New anonymous user session acts as if it's created with password | MEDIUM 6.5 | 1.0 % | ||
| CVE-2020-26288 | < 4.5.0 | Parse Server stores password in plain text | HIGH 7.7 | 0.8 % | ||
| CVE-2020-15270 | <= 4.3.0 | Improper session expiration in Parse Server | MEDIUM 4.3 | 1.2 % | ||
| CVE-2020-15126 | >= 3.5.0, < 4.3.0 | Information disclosure through Viewer query in parse-server | MEDIUM 6.5 | 1.1 % | ||
| CVE-2020-5251 | < 4.1.0 | Information disclosure in parse-server | HIGH 7.7 | 0.8 % |