parse-community parse-server

• CVE-2026-122301 Low 3.1 Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response 0.2%
• CVE-2026-121965 Medium 5.3 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key 0.4%
• CVE-2026-121415 Low 3.7 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key 0.4%
• CVE-2026-121414 Medium 5.9 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update 0.3%
• CVE-2026-121413 Low 3.1 Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession 0.3%
• CVE-2026-120310 Low 3.1 Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response 0.2%
• CVE-2026-119571 Low 3.7 Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID 0.2%
• CVE-2026-119570 Low 3.1 Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses 0.3%
• CVE-2026-119569 Medium 5.3 Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service 0.4%
• CVE-2026-119126 Low 3.1 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys 0.3%
• CVE-2026-119125 Low 3.1 Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields 0.3%
• CVE-2026-116801 Medium 4.3 Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query 0.3%
• CVE-2026-116165 High 8.8 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB 0.3%
• CVE-2026-116164 Medium 6.3 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes 0.3%
• CVE-2026-116163 High 7.4 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 0.3%
• CVE-2026-116162 Low 2.1 Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login 0.4%
• CVE-2026-116161 Medium 6.0 Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions 0.3%
• CVE-2026-112769 Low 2.3 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass 0.3%
• CVE-2026-112768 Medium 6.9 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update 0.4%
• CVE-2026-110854 High 8.2 Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error 0.3%
• CVE-2026-109954 Medium 6.5 Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference 0.2%
• CVE-2026-109303 Medium 4.3 Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query 0.2%
• CVE-2026-109302 Low 3.7 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries 0.2%
• CVE-2026-109301 Medium 5.9 Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL 0.3%
• CVE-2026-105828 Medium 6.3 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors 0.3%
• CVE-2026-101042 Medium 6.4 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity 0.2%
• CVE-2026-100632 Medium 6.5 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery 0.3%
• CVE-2026-100631 High 7.5 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection 0.4%
• CVE-2026-87806 High 7.4 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password 0.5%
• CVE-2026-66009 Medium 6.3 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages 0.4%
• CVE-2026-66008 Medium 6.3 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages 0.6%
• CVE-2026-64627 Medium 6.9 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion 0.5%
• CVE-2026-61448 Low 2.1 Parse Server 9.0.0 Stored XSS via malformed Content-Type 0.4%
• CVE-2026-57481 Low 2.3 Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change 0.5%
• CVE-2026-57480 High 8.7 Parse Server: Denial of service via exponential-time processing of deeply nested query operators 0.6%
• CVE-2026-55778 Low 2.1 Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist 0.6%
• CVE-2021-47987 High 7.5 Parse Server - Arbitrary Code Execution via Malicious Version Tags 0.2%
• CVE-2021-47986 High 7.5 Parse Server - Unreviewed Code Execution via Malicious Version Tags 0.2%
• CVE-2026-53726 Medium 6.9 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL 0.3%
• CVE-2026-53725 Medium 5.9 Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied 0.3%
• CVE-2026-53724 Low 2.1 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist 0.3%
• CVE-2026-50008 Medium 6.9 Parse Server: Server option routeAllowList is bypassable through batch sub-requests 0.3%
• CVE-2026-47138 High 8.7 Parse Server: Pre-authentication denial of service via client version header regex backtracking 0.6%
• CVE-2026-47248 Medium 6.9 Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers 0.3%
• CVE-2026-43930 Low 2.1 Parse Server: MFA SMS one-time password accepted twice under concurrent login 0.2%
• CVE-2026-39381 Medium 5.3 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` 0.2%
• CVE-2026-39321 Medium 6.3 Parse Server has a login timing side-channel reveals user existence 0.2%
• CVE-2026-35200 Low 2.1 Parse Server has a file upload Content-Type override via extension mismatch 0.2%
• CVE-2026-34784 High 8.2 Parse Server: Streaming file download bypasses afterFind file trigger authorization 0.4%
• CVE-2026-34215 Medium 6.5 Parse Server: Auth data exposed via verify password endpoint 0.3%