PA
Vendor
Parseplatform
109
CVEs
0
On KEV
0
New 30D
Products
PS10.0
Parse Server
Parseplatform
103 CVEs0 on KEV0 new
PD8.1
Parse Dashboard
Parseplatform
4 CVEs0 on KEV0 new
PJ6.5
Parse Javascript Sdk
Parseplatform
1 CVEs0 on KEV0 new
PS7.5
Parse Server Push Adapter
Parseplatform
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2021-47986 | PA Parse-server Parseplatform | 7.5 | Jun 25 | Parse Server - Unreviewed Code Execution via Malicious Version Tags |
| CVE-2026-43930 | PA Parse-server Parseplatform | 5.9 | May 12 | Parse Server: MFA SMS one-time password accepted twice under concurrent login |
| CVE-2026-39381 | PA Parse-server Parseplatform | 4.3 | Apr 7 | Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` |
| CVE-2026-39321 | PA Parse-server Parseplatform | 3.7 | Apr 7 | Parse Server has a login timing side-channel reveals user existence |
| CVE-2026-35200 | PA Parse-server Parseplatform | 5.4 | Apr 6 | Parse Server has a file upload Content-Type override via extension mismatch |
| CVE-2026-34784 | PA Parse-server Parseplatform | 7.5 | Mar 31 | Parse Server: Streaming file download bypasses afterFind file trigger authorization |
| CVE-2026-34215 | PA Parse-server Parseplatform | 6.5 | Mar 31 | Parse Server: Auth data exposed via verify password endpoint |
| CVE-2026-34595 | PA Parse-server Parseplatform | 4.3 | Mar 31 | Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value |
| CVE-2026-34574 | PA Parse-server Parseplatform | 5.4 | Mar 31 | Parse Server: Session field immutability bypass via falsy-value guard |
| CVE-2026-34573 | PA Parse-server Parseplatform | 7.5 | Mar 31 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS |
| CVE-2026-34532 | PA Parse-server Parseplatform | 9.1 | Mar 31 | Parse Server: Cloud function validator bypass via prototype chain traversal |
| CVE-2026-34373 | PA Parse-server Parseplatform | 8.8 | Mar 31 | Parse Server: GraphQL API endpoint ignores CORS origin restriction |
| CVE-2026-34363 | PA Parse-server Parseplatform | 5.3 | Mar 31 | Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers |
| CVE-2026-34224 | PA Parse-server Parseplatform | 4.4 | Mar 31 | Parse Server: MFA single-use token bypass via concurrent authData login requests |
| CVE-2026-33627 | PA Parse-server Parseplatform | 6.5 | Mar 24 | Parse Server: Auth data exposed via /users/me endpoint |
| CVE-2026-33624 | PA Parse-server Parseplatform | 2.7 | Mar 24 | Parse Server: MFA recovery code single-use bypass via concurrent requests |
| CVE-2026-33539 | PA Parse-server Parseplatform | 7.2 | Mar 24 | Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter |
| CVE-2026-33538 | PA Parse-server Parseplatform | 7.5 | Mar 24 | Parse Server: Denial of service via unindexed database query for unconfigured auth providers |
| CVE-2026-33527 | PA Parse-server Parseplatform | 4.3 | Mar 24 | Parse Server: Session update endpoint allows overwriting server-generated session fields |
| CVE-2026-33508 | PA Parse-server Parseplatform | 7.5 | Mar 24 | Parse Server: LiveQuery subscription query depth bypass |
| CVE-2026-33498 | PA Parse-server Parseplatform | 7.5 | Mar 24 | Parse Server: Query condition depth bypass via pre-validation transform pipeline |
| CVE-2026-33429 | PA Parse-server Parseplatform | 5.3 | Mar 24 | Parse Server: Protected field change detection oracle via LiveQuery watch parameter |
| CVE-2026-33421 | PA Parse-server Parseplatform | 6.5 | Mar 24 | Parse Server: LiveQuery bypasses CLP pointer permission enforcement |
| CVE-2026-33409 | PA Parse-server Parseplatform | 9.1 | Mar 24 | Parse Server: Auth provider validation bypass on login via partial authData |
| CVE-2026-33323 | PA Parse-server Parseplatform | 5.3 | Mar 24 | Parse Server: Email verification resend page leaks user existence |
| CVE-2026-33163 | PA Parse-server Parseplatform | 6.5 | Mar 18 | Parse Server leaks protected fields via LiveQuery afterEvent trigger |
| CVE-2026-33042 | PA Parse-server Parseplatform | 5.3 | Mar 18 | Parse Server affected by empty authData bypassing credential requirement on signup |
| CVE-2026-32944 | PA Parse-server Parseplatform | 7.5 | Mar 18 | Parse Server crash via deeply nested query condition operators |
| CVE-2026-32943 | PA Parse-server Parseplatform | 3.1 | Mar 18 | Parse Server has a password reset token single-use bypass via concurrent requests |
| CVE-2026-32886 | PA Parse-server Parseplatform | 7.5 | Mar 18 | Parse Server's Cloud function dispatch crashes server via prototype chain traversal |
| CVE-2026-32878 | PA Parse-server Parseplatform | 7.5 | Mar 18 | Parse Server vulnerable to schema poisoning via prototype pollution in deep copy |
| CVE-2026-32770 | PA Parse-server Parseplatform | 7.5 | Mar 18 | Parse Server: LiveQuery subscription with invalid regular expression crashes server |
| CVE-2026-32742 | PA Parse-server Parseplatform | 4.3 | Mar 18 | Parse Server session creation endpoint allows overwriting server-generated session fields |
| CVE-2026-32728 | PA Parse-server Parseplatform | 7.6 | Mar 18 | Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries |
| CVE-2026-32594 | PA Parse-server Parseplatform | 7.3 | Mar 13 | Parse Server GraphQL WebSocket endpoint bypasses security middleware |
| CVE-2026-32269 | PA Parse-server Parseplatform | 6.5 | Mar 12 | Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint |
| CVE-2026-32248 | PA Parse-server Parseplatform | 9.8 | Mar 12 | Parse Server: Account takeover via operator injection in authentication data identifier |
| CVE-2026-32242 | PA Parse-server Parseplatform | 7.4 | Mar 12 | Parse Server OAuth2 adapter shares mutable state across providers via singleton instance |
| CVE-2026-32234 | PA Parse-server Parseplatform | 4.7 | Mar 11 | Parse Server has a SQL injection via query field name when using PostgreSQL |
| CVE-2026-32098 | PA Parse-server Parseplatform | 7.5 | Mar 11 | Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause |
| CVE-2026-31901 | PA Parse-server Parseplatform | 5.3 | Mar 11 | Parse Server has user enumeration via email verification endpoint |
| CVE-2026-31875 | PA Parse-server Parseplatform | 5.9 | Mar 11 | Parse Server MFA recovery codes not consumed after use |
| CVE-2026-31872 | PA Parse-server Parseplatform | 7.5 | Mar 11 | Parse Server has a protected fields bypass via dot-notation in query and sort |
| CVE-2026-31871 | PA Parse-server Parseplatform | 9.8 | Mar 11 | Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL |
| CVE-2026-31868 | PA Parse-server Parseplatform | 6.1 | Mar 11 | Parse Server has Stored XSS via file upload of HTML-renderable file types |
| CVE-2026-31856 | PA Parse-server Parseplatform | 9.8 | Mar 11 | Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL |
| CVE-2026-31840 | PA Parse-server Parseplatform | 9.8 | Mar 11 | Parse Server has a SQL injection via dot-notation field name in PostgreSQL |
| CVE-2026-31828 | PA Parse-server Parseplatform | 8.8 | Mar 10 | Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction |
| CVE-2026-31800 | PA Parse-server Parseplatform | 9.1 | Mar 10 | Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes |
| CVE-2026-30972 | PA Parse-server Parseplatform | 7.5 | Mar 10 | Parse Server has a rate limit bypass via batch request endpoint |
| CVE-2026-30967 | PA Parse-server Parseplatform | 8.8 | Mar 10 | Parse Server OAuth2 authentication adapter account takeover via identity spoofing |
| CVE-2026-30966 | PA Parse-server Parseplatform | 10.0 | Mar 10 | Parse Server role escalation and CLP bypass via direct `_Join` table write |
| CVE-2026-30965 | PA Parse-server Parseplatform | 9.1 | Mar 10 | Parse Server session token exfiltration via `redirectClassNameForKey` query parameter |
| CVE-2026-30962 | PA Parse-server Parseplatform | 6.5 | Mar 10 | Parse Server has a protected fields bypass via logical query operators |
| CVE-2026-30949 | PA Parse-server Parseplatform | 8.8 | Mar 10 | Parse Server is missing audience validation in Keycloak authentication adapter |
| CVE-2026-30948 | PA Parse-server Parseplatform | 5.4 | Mar 10 | Parse Server has stored cross-site scripting (XSS) via SVG file upload |
| CVE-2026-30947 | PA Parse-server Parseplatform | 7.5 | Mar 10 | Parse Server ha a bypass of class-level permissions in LiveQuery |
| CVE-2026-30946 | PA Parse-server Parseplatform | 7.5 | Mar 10 | Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API |
| CVE-2026-30941 | PA Parse-server Parseplatform | 7.5 | Mar 10 | Parse Server has a NoSQL injection via token type in password reset and email verification endpoints |
| CVE-2026-30939 | PA Parse-server Parseplatform | 7.5 | Mar 10 | Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution |