PA
Product
parse-server
117
CVEs
0
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 15High 39Medium 50Low 13
Watch
Add parse-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-39381 | 4.3 | Apr 7 | Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` Affected: >= 9.0.0, < 9.8.0-alpha.7; >= 7.0.0, < 8.6.75 |
| CVE-2026-34595 | 4.3 | Mar 31 | Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value Affected: < 8.6.70; >= 9.0.0, < 9.7.0-alpha.18 |
| CVE-2026-33527 | 4.3 | Mar 24 | Parse Server: Session update endpoint allows overwriting server-generated session fields Affected: < 8.6.57; >= 9.0.0, < 9.6.0-alpha.48 |
| CVE-2026-32742 | 4.3 | Mar 18 | Parse Server session creation endpoint allows overwriting server-generated session fields Affected: >= 9.0.0, < 9.6.0-alpha.17; < 8.6.42 |
| CVE-2026-109302 | 3.7 | Oct 12 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries Affected: 9.0.0 before 9.10.1-alpha.14; 8.2.2 before 8.6.94 |
| CVE-2026-39321 | 3.7 | Apr 7 | Parse Server has a login timing side-channel reveals user existence Affected: >= 9.0.0, < 9.8.0-alpha.6; < 8.6.74 |
| CVE-2026-30848 | 3.7 | Mar 7 | Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory Affected: < 8.6.8; < 9.5.0-alpha.8 |
| CVE-2026-119126 New | 3.1 | Oct 29 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys Affected: 9.0.0 before 9.10.5-alpha.7; before 8.6.106 |
| CVE-2026-119125 New | 3.1 | Oct 29 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields Affected: 9.0.0 before 9.10.5-alpha.8; before 8.6.107 |
| CVE-2026-32943 | 3.1 | Mar 18 | Parse Server has a password reset token single-use bypass via concurrent requests Affected: >= 9.0.0, < 9.6.0-alpha.28; < 8.6.48 |
| CVE-2026-33624 | 2.7 | Mar 24 | Parse Server: MFA recovery code single-use bypass via concurrent requests Affected: < 8.6.60; >= 9.0.0, < 9.6.0-alpha.54 |
| CVE-2026-112769 | 2.3 | Oct 19 | Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass Affected: 9.0.0 before 9.10.3-alpha.1; before 8.6.98 |
| CVE-2026-57481 | 2.3 | Jul 8 | Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change Affected: >= 9.0.0-alpha.1, < 9.9.1-alpha.13; < 8.6.83 |
| CVE-2026-116162 New | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login Affected: 9.0.0 before 9.10.5-alpha.5; before 8.6.104 |
| CVE-2026-61448 | 2.1 | Jul 11 | Parse Server 9.0.0 Stored XSS via malformed Content-Type Affected: 9.0.0 before 9.10.0-alpha.2; before 8.6.84 |
| CVE-2026-55778 | 2.1 | Jul 8 | Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist Affected: >= 9.0.0-alpha.1, < 9.9.1-alpha.11; < 8.6.81 |
| CVE-2026-53724 | 2.1 | Jun 12 | Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist Affected: < 8.6.79; >= 9.0.0, < 9.9.1-alpha.4 |