Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server has a login timing side-channel reveals user existence

Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

Parse Server has a password reset token single-use bypass via concurrent requests

Parse Server: MFA recovery code single-use bypass via concurrent requests

Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change

Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist