PA
Product
parse-server
104
CVEs
0
On KEV
10.0
Max CVSS
14
New 30D
Severity mix
Critical 11High 37Medium 45Low 11
Watch
Add parse-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116162 New | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login Affected: 9.0.0 before 9.10.5-alpha.5; before 8.6.104 |
| CVE-2026-61448 | 2.1 | Jul 11 | Parse Server 9.0.0 Stored XSS via malformed Content-Type Affected: 9.0.0 before 9.10.0-alpha.2; before 8.6.84 |
| CVE-2026-55778 | 2.1 | Jul 8 | Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist Affected: >= 9.0.0-alpha.1, < 9.9.1-alpha.11; < 8.6.81 |
| CVE-2026-53724 | 2.1 | Jun 12 | Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist Affected: < 8.6.79; >= 9.0.0, < 9.9.1-alpha.4 |