PA
Vendor
parse-community
103
CVEs
0
On KEV
14
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116801 New | PA parse-server parse-community | 4.3 | Oct 26 | Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query |
| CVE-2026-116165 New | PA parse-server parse-community | 8.8 | Oct 25 | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB |
| CVE-2026-116164 New | PA parse-server parse-community | 6.3 | Oct 25 | Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes |
| CVE-2026-116163 New | PA parse-server parse-community | 7.4 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses |
| CVE-2026-116162 New | PA parse-server parse-community | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login |
| CVE-2026-116161 New | PA parse-server parse-community | 6.0 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions |
| CVE-2026-112769 | PA parse-server parse-community | 2.3 | Oct 19 | Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass |
| CVE-2026-112768 | PA parse-server parse-community | 6.9 | Oct 19 | Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update |
| CVE-2026-110854 | PA parse-server parse-community | 8.2 | Oct 14 | Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error |
| CVE-2026-109954 | PA parse-server parse-community | 6.5 | Oct 13 | Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference |
| CVE-2026-109303 | PA parse-server parse-community | 4.3 | Oct 12 | Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query |
| CVE-2026-109302 | PA parse-server parse-community | 3.7 | Oct 12 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries |
| CVE-2026-109301 | PA parse-server parse-community | 5.9 | Oct 12 | Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL |
| CVE-2026-105828 | PA parse-server parse-community | 6.3 | Oct 8 | Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors |
| CVE-2026-101042 | PA parse-server parse-community | 6.4 | Sep 27 | Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity |
| CVE-2026-100632 | PA parse-server parse-community | 6.5 | Sep 26 | Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery |
| CVE-2026-100631 | PA parse-server parse-community | 7.5 | Sep 26 | Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection |
| CVE-2026-87806 | PA parse-server parse-community | 7.4 | Sep 9 | Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password |
| CVE-2026-66009 | PA parse-server parse-community | 6.3 | Jul 24 | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages |
| CVE-2026-66008 | PA parse-server parse-community | 6.3 | Jul 24 | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages |
| CVE-2026-64627 | PA parse-server parse-community | 6.9 | Jul 21 | Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion |
| CVE-2026-61448 | PA parse-server parse-community | 2.1 | Jul 11 | Parse Server 9.0.0 Stored XSS via malformed Content-Type |
| CVE-2026-57481 | PA parse-server parse-community | 2.3 | Jul 8 | Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change |
| CVE-2026-57480 | PA parse-server parse-community | 8.7 | Jul 8 | Parse Server: Denial of service via exponential-time processing of deeply nested query operators |
| CVE-2026-55778 | PA parse-server parse-community | 2.1 | Jul 8 | Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist |
| CVE-2021-47987 | PA parse-server parse-community | 7.5 | Jun 25 | Parse Server - Arbitrary Code Execution via Malicious Version Tags |
| CVE-2021-47986 | PA parse-server parse-community | 7.5 | Jun 25 | Parse Server - Unreviewed Code Execution via Malicious Version Tags |
| CVE-2026-53726 | PA parse-server parse-community | 6.9 | Jun 12 | Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL |
| CVE-2026-53725 | PA parse-server parse-community | 5.9 | Jun 12 | Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied |
| CVE-2026-53724 | PA parse-server parse-community | 2.1 | Jun 12 | Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist |
| CVE-2026-50008 | PA parse-server parse-community | 6.9 | Jun 12 | Parse Server: Server option routeAllowList is bypassable through batch sub-requests |
| CVE-2026-47138 | PA parse-server parse-community | 8.7 | Jun 12 | Parse Server: Pre-authentication denial of service via client version header regex backtracking |
| CVE-2026-47248 | PA parse-server parse-community | 6.9 | Jun 12 | Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers |
| CVE-2026-43930 | PA parse-server parse-community | 5.9 | May 12 | Parse Server: MFA SMS one-time password accepted twice under concurrent login |
| CVE-2026-39381 | PA parse-server parse-community | 4.3 | Apr 7 | Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` |
| CVE-2026-39321 | PA parse-server parse-community | 3.7 | Apr 7 | Parse Server has a login timing side-channel reveals user existence |
| CVE-2026-35200 | PA parse-server parse-community | 5.4 | Apr 6 | Parse Server has a file upload Content-Type override via extension mismatch |
| CVE-2026-34784 | PA parse-server parse-community | 7.5 | Mar 31 | Parse Server: Streaming file download bypasses afterFind file trigger authorization |
| CVE-2026-34215 | PA parse-server parse-community | 6.5 | Mar 31 | Parse Server: Auth data exposed via verify password endpoint |
| CVE-2026-34595 | PA parse-server parse-community | 4.3 | Mar 31 | Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value |
| CVE-2026-34574 | PA parse-server parse-community | 5.4 | Mar 31 | Parse Server: Session field immutability bypass via falsy-value guard |
| CVE-2026-34573 | PA parse-server parse-community | 7.5 | Mar 31 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS |
| CVE-2026-34532 | PA parse-server parse-community | 9.1 | Mar 31 | Parse Server: Cloud function validator bypass via prototype chain traversal |
| CVE-2026-34373 | PA parse-server parse-community | 8.8 | Mar 31 | Parse Server: GraphQL API endpoint ignores CORS origin restriction |
| CVE-2026-34363 | PA parse-server parse-community | 5.3 | Mar 31 | Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers |
| CVE-2026-34224 | PA parse-server parse-community | 4.4 | Mar 31 | Parse Server: MFA single-use token bypass via concurrent authData login requests |
| CVE-2026-33627 | PA parse-server parse-community | 6.5 | Mar 24 | Parse Server: Auth data exposed via /users/me endpoint |
| CVE-2026-33624 | PA parse-server parse-community | 2.7 | Mar 24 | Parse Server: MFA recovery code single-use bypass via concurrent requests |
| CVE-2026-33539 | PA parse-server parse-community | 7.2 | Mar 24 | Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter |
| CVE-2026-33538 | PA parse-server parse-community | 7.5 | Mar 24 | Parse Server: Denial of service via unindexed database query for unconfigured auth providers |
| CVE-2026-33527 | PA parse-server parse-community | 4.3 | Mar 24 | Parse Server: Session update endpoint allows overwriting server-generated session fields |
| CVE-2026-33508 | PA parse-server parse-community | 7.5 | Mar 24 | Parse Server: LiveQuery subscription query depth bypass |
| CVE-2026-33498 | PA parse-server parse-community | 7.5 | Mar 24 | Parse Server: Query condition depth bypass via pre-validation transform pipeline |
| CVE-2026-33429 | PA parse-server parse-community | 5.3 | Mar 24 | Parse Server: Protected field change detection oracle via LiveQuery watch parameter |
| CVE-2026-33421 | PA parse-server parse-community | 6.5 | Mar 24 | Parse Server: LiveQuery bypasses CLP pointer permission enforcement |
| CVE-2026-33409 | PA parse-server parse-community | 9.1 | Mar 24 | Parse Server: Auth provider validation bypass on login via partial authData |
| CVE-2026-33323 | PA parse-server parse-community | 5.3 | Mar 24 | Parse Server: Email verification resend page leaks user existence |
| CVE-2026-33163 | PA parse-server parse-community | 6.5 | Mar 18 | Parse Server leaks protected fields via LiveQuery afterEvent trigger |
| CVE-2026-33042 | PA parse-server parse-community | 5.3 | Mar 18 | Parse Server affected by empty authData bypassing credential requirement on signup |
| CVE-2026-32944 | PA parse-server parse-community | 7.5 | Mar 18 | Parse Server crash via deeply nested query condition operators |