Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server: Server option routeAllowList is bypassable through batch sub-requests

Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server: Auth data exposed via verify password endpoint

Parse Server: Auth data exposed via /users/me endpoint

Parse Server: LiveQuery bypasses CLP pointer permission enforcement

Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server has a protected fields bypass via logical query operators

Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server has Stored XSS via file upload of HTML-renderable file types

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL

Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

Parse Server: MFA SMS one-time password accepted twice under concurrent login

Parse Server MFA recovery codes not consumed after use

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Parse Server has a file upload Content-Type override via extension mismatch

Parse Server: Session field immutability bypass via falsy-value guard

Parse Server has stored cross-site scripting (XSS) via SVG file upload

Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server: Email verification resend page leaks user existence

Parse Server affected by empty authData bypassing credential requirement on signup

Parse Server has user enumeration via email verification endpoint

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Parse Server: Malformed `$regex` query leaks database error details in API response

Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server has a SQL injection via query field name when using PostgreSQL

Parse Server: MFA single-use token bypass via concurrent authData login requests

Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Parse Server: Session update endpoint allows overwriting server-generated session fields

Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server has a login timing side-channel reveals user existence

Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

Parse Server has a password reset token single-use bypass via concurrent requests

Parse Server: MFA recovery code single-use bypass via concurrent requests

Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change