parse-community parse-server

• CVE-2026-34595 Medium 5.3 Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value 0.3%
• CVE-2026-34574 Medium 5.3 Parse Server: Session field immutability bypass via falsy-value guard 0.2%
• CVE-2026-34573 High 8.2 Parse Server: GraphQL complexity validator exponential fragment traversal DoS 0.6%
• CVE-2026-34532 Critical 9.1 Parse Server: Cloud function validator bypass via prototype chain traversal 0.3%
• CVE-2026-34373 Medium 5.3 Parse Server: GraphQL API endpoint ignores CORS origin restriction 0.2%
• CVE-2026-34363 High 8.2 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers 0.4%
• CVE-2026-34224 Medium 4.4 Parse Server: MFA single-use token bypass via concurrent authData login requests 0.3%
• CVE-2026-33627 High 7.1 Parse Server: Auth data exposed via /users/me endpoint 0.4%
• CVE-2026-33624 Low 2.1 Parse Server: MFA recovery code single-use bypass via concurrent requests 0.2%
• CVE-2026-33539 High 8.6 Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter 0.5%
• CVE-2026-33538 High 8.7 Parse Server: Denial of service via unindexed database query for unconfigured auth providers 0.4%
• CVE-2026-33527 Medium 5.3 Parse Server: Session update endpoint allows overwriting server-generated session fields 0.3%
• CVE-2026-33508 High 8.2 Parse Server: LiveQuery subscription query depth bypass 0.4%
• CVE-2026-33498 High 8.7 Parse Server: Query condition depth bypass via pre-validation transform pipeline 0.5%
• CVE-2026-33429 Medium 6.3 Parse Server: Protected field change detection oracle via LiveQuery watch parameter 0.3%
• CVE-2026-33421 High 7.1 Parse Server: LiveQuery bypasses CLP pointer permission enforcement 0.4%
• CVE-2026-33409 High 7.0 Parse Server: Auth provider validation bypass on login via partial authData 0.5%
• CVE-2026-33323 Medium 6.3 Parse Server: Email verification resend page leaks user existence 0.3%
• CVE-2026-33163 High 8.2 Parse Server leaks protected fields via LiveQuery afterEvent trigger 0.4%
• CVE-2026-33042 Medium 6.9 Parse Server affected by empty authData bypassing credential requirement on signup 0.3%
• CVE-2026-32944 High 8.7 Parse Server crash via deeply nested query condition operators 0.5%
• CVE-2026-32943 Low 2.3 Parse Server has a password reset token single-use bypass via concurrent requests 0.2%
• CVE-2026-32886 High 8.2 Parse Server's Cloud function dispatch crashes server via prototype chain traversal 0.5%
• CVE-2026-32878 Medium 5.3 Parse Server vulnerable to schema poisoning via prototype pollution in deep copy 0.4%
• CVE-2026-32770 Medium 5.9 Parse Server: LiveQuery subscription with invalid regular expression crashes server 0.6%
• CVE-2026-32742 Medium 4.3 Parse Server session creation endpoint allows overwriting server-generated session fields 0.3%
• CVE-2026-32728 High 8.3 Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries 0.3%
• CVE-2026-32594 Medium 6.9 Parse Server GraphQL WebSocket endpoint bypasses security middleware 0.4%
• CVE-2026-32269 Medium 6.3 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint 0.3%
• CVE-2026-32248 Critical 9.3 Parse Server: Account takeover via operator injection in authentication data identifier 0.6%
• CVE-2026-32242 Critical 9.1 Parse Server OAuth2 adapter shares mutable state across providers via singleton instance 0.3%
• CVE-2026-32234 Medium 5.1 Parse Server has a SQL injection via query field name when using PostgreSQL 0.2%
• CVE-2026-32098 Medium 6.9 Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause 0.3%
• CVE-2026-31901 Medium 6.3 Parse Server has user enumeration via email verification endpoint 0.3%
• CVE-2026-31875 High 8.2 Parse Server MFA recovery codes not consumed after use 0.5%
• CVE-2026-31872 High 8.7 Parse Server has a protected fields bypass via dot-notation in query and sort 0.4%
• CVE-2026-31871 Critical 9.3 Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL 0.5%
• CVE-2026-31868 Medium 6.3 Parse Server has Stored XSS via file upload of HTML-renderable file types 0.3%
• CVE-2026-31856 Critical 9.3 Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL 0.5%
• CVE-2026-31840 Critical 9.3 Parse Server has a SQL injection via dot-notation field name in PostgreSQL 0.5%
• CVE-2026-31828 Medium 6.0 Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction 0.5%
• CVE-2026-31800 High 8.8 Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes 0.4%
• CVE-2026-30972 Medium 6.9 Parse Server has a rate limit bypass via batch request endpoint 0.4%
• CVE-2026-30967 High 7.6 Parse Server OAuth2 authentication adapter account takeover via identity spoofing 0.4%
• CVE-2026-30966 Critical 10.0 Parse Server role escalation and CLP bypass via direct `_Join` table write 0.4%
• CVE-2026-30965 Critical 9.9 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter 1.5%
• CVE-2026-30962 High 7.1 Parse Server has a protected fields bypass via logical query operators 0.3%
• CVE-2026-30949 High 7.6 Parse Server is missing audience validation in Keycloak authentication adapter 0.5%
• CVE-2026-30948 High 8.3 Parse Server has stored cross-site scripting (XSS) via SVG file upload 0.2%
• CVE-2026-30947 High 8.7 Parse Server ha a bypass of class-level permissions in LiveQuery 0.5%