Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server: Auth provider validation bypass on login via partial authData

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Parse Server: GraphQL API endpoint ignores CORS origin restriction

Parse Server: Denial of service via exponential-time processing of deeply nested query operators

Parse Server: Pre-authentication denial of service via client version header regex backtracking

Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

Parse Server: LiveQuery subscription query depth bypass

Parse Server: Query condition depth bypass via pre-validation transform pipeline

Parse Server crash via deeply nested query condition operators

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server: LiveQuery subscription with invalid regular expression crashes server

Parse Server crashes when receiving file download request with invalid byte range

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server: Server option routeAllowList is bypassable through batch sub-requests

Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server: Auth data exposed via verify password endpoint

Parse Server: Auth data exposed via /users/me endpoint

Parse Server: LiveQuery bypasses CLP pointer permission enforcement

Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL

Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

Parse Server: MFA SMS one-time password accepted twice under concurrent login

Parse Server has a file upload Content-Type override via extension mismatch

Parse Server: Session field immutability bypass via falsy-value guard

Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server: Email verification resend page leaks user existence

Parse Server affected by empty authData bypassing credential requirement on signup