parse-community parse-server

• CVE-2026-30946 High 8.7 Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API 0.6%
• CVE-2026-30941 High 8.7 Parse Server has a NoSQL injection via token type in password reset and email verification endpoints 0.5%
• CVE-2026-30939 High 8.8 Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution 0.6%
• CVE-2026-30938 Medium 6.9 Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement 0.5%
• CVE-2026-30925 High 8.2 Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery 0.5%
• CVE-2026-30854 Medium 6.9 Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled 0.3%
• CVE-2026-30850 Medium 6.3 Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization 0.3%
• CVE-2026-30848 Medium 6.3 Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory 0.3%
• CVE-2026-30863 Critical 9.3 Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters 0.6%
• CVE-2026-30835 Medium 6.9 Parse Server: Malformed `$regex` query leaks database error details in API response 0.4%
• CVE-2026-30229 High 8.5 Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user 0.4%
• CVE-2026-30228 Medium 6.9 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction 0.4%
• CVE-2026-29182 High 8.6 Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction 0.4%
• CVE-2026-27804 Critical 9.3 Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter 0.2%
• CVE-2025-68150 High 8.3 Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter 0.3%
• CVE-2025-68115 Medium 5.3 Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables 0.2%
• CVE-2025-67727 Medium 6.9 Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management 0.4%
• CVE-2025-64502 Medium 6.9 Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details 0.4%
• CVE-2025-64430 High 7.5 Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format 0.6%
• CVE-2025-53364 Medium 5.3 Parse Server exposes the data schema via GraphQL API 1.0%
• CVE-2025-30168 Medium 6.9 Parse Server has an OAuth login vulnerability 0.4%
• CVE-2024-47183 High 8.1 Parse Server's custom object ID allows to acquire role privileges 0.4%
• CVE-2024-39309 Critical 9.8 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability 20.2%
• CVE-2024-29027 Critical 9.1 Parse Server crash and RCE via invalid Cloud Function or Cloud Job name 1.2%
• CVE-2024-27298 Critical 10.0 Parse Server literalizeRegexPart SQL Injection 1.0%
• CVE-2023-46119 High 7.5 Parse Server may crash when uploading file without extension 1.3%
• CVE-2023-41058 High 7.5 Trigger `beforeFind` not invoked in internal query pipeline in parse-server 0.8%
• CVE-2023-36475 Critical 9.8 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution 3.2%
• CVE-2023-32689 Medium 6.3 Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file 0.6%
• CVE-2023-22474 High 8.7 Parse Server is vulnerable to authentication bypass via spoofing 0.7%
• CVE-2022-41878 High 7.2 Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers 1.0%
• CVE-2022-39396 Critical 9.8 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser 38.7%
• CVE-2022-41879 High 7.2 Parse Server subject to Prototype pollution via Cloud Code Webhooks 0.9%
• CVE-2022-39313 High 7.5 Parse Server crashes when receiving file download request with invalid byte range 0.8%
• CVE-2022-39231 Low 3.7 Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented 0.5%
• CVE-2022-39225 Medium 4.3 Parse Server subject to Incorrect Resource Transfer Between Spheres 0.5%
• CVE-2022-36079 High 8.6 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns 1.3%
• CVE-2022-31112 High 8.2 Protected fields exposed via LiveQuery in parse-server 1.3%
• CVE-2022-31089 High 7.5 Invalid file request can crashe parse-server 1.2%
• CVE-2022-31083 High 8.6 Authentication bypass in Parse Server Apple Game Center auth adapter 0.9%
• CVE-2022-24901 High 7.5 Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter 0.7%
• CVE-2022-24760 Critical 10.0 Command Injection in Parse server 49.4%
• CVE-2021-41109 High 7.5 LiveQuery publishes user session tokens 1.2%
• CVE-2021-39187 High 7.5 Crash server with query parameter 1.8%
• CVE-2021-39138 Medium 4.8 New anonymous user session acts as if it's created with password 1.0%
• CVE-2020-26288 High 7.7 Parse Server stores password in plain text 0.8%
• CVE-2020-15270 Medium 4.3 Improper session expiration in Parse Server 1.2%
• CVE-2020-15126 Medium 6.5 Information disclosure through Viewer query in parse-server 1.1%
• CVE-2020-5251 High 7.7 Information disclosure in parse-server 0.8%