Log in Start free

parse-community

Products

ProductCVEsExploitedLatest
parse-server149–Nov 5, 2026
parse-dashboard4–Feb 25, 2026
Parse-SDK-JS1–Oct 14, 2025
parse-server-push-adapter1–May 27, 2023

Exploited and recent CVEs

  • CVE-2026-122301 Low 3.1 Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response 0.2%
  • CVE-2026-121965 Medium 5.3 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key 0.4%
  • CVE-2026-121415 Low 3.7 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key 0.4%
  • CVE-2026-121414 Medium 5.9 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update 0.3%
  • CVE-2026-121413 Low 3.1 Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession 0.3%
  • CVE-2026-120310 Low 3.1 Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response 0.2%
  • CVE-2026-119571 Low 3.7 Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID 0.2%
  • CVE-2026-119570 Low 3.1 Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses 0.3%
  • CVE-2026-119569 Medium 5.3 Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service 0.4%
  • CVE-2026-119126 Low 3.1 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys 0.3%
  • CVE-2026-119125 Low 3.1 Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields 0.3%
  • CVE-2026-116801 Medium 4.3 Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query 0.3%
  • CVE-2026-116165 High 8.8 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB 0.3%
  • CVE-2026-116164 Medium 6.3 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes 0.3%
  • CVE-2026-116163 High 7.4 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 0.3%
  • CVE-2026-116162 Low 2.1 Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login 0.4%
  • CVE-2026-116161 Medium 6.0 Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions 0.3%
  • CVE-2026-112769 Low 2.3 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass 0.3%
  • CVE-2026-112768 Medium 6.9 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update 0.4%
  • CVE-2026-110854 High 8.2 Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error 0.3%
  • CVE-2026-109954 Medium 6.5 Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference 0.2%
  • CVE-2026-109303 Medium 4.3 Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query 0.2%
  • CVE-2026-109302 Low 3.7 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries 0.2%
  • CVE-2026-109301 Medium 5.9 Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL 0.3%
  • CVE-2026-105828 Medium 6.3 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors 0.3%
  • CVE-2026-101042 Medium 6.4 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity 0.2%
  • CVE-2026-100632 Medium 6.5 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery 0.3%
  • CVE-2026-100631 High 7.5 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection 0.4%
  • CVE-2026-87806 High 7.4 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password 0.5%
  • CVE-2026-66009 Medium 6.3 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages 0.4%