PS
Product
Parse Server
103
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 19High 41Medium 37Low 6
Watch
Add Parse Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30966 | 10.0 | Mar 10 | Parse Server role escalation and CLP bypass via direct `_Join` table write Affected: before 8.6.20; 9.0.0 before 9.5.2; 9.5.2; 9.5.2; 9.5.2; 9.5.2; +2 more |
| CVE-2024-27298 | 10.0 | Mar 1 | Parse Server literalizeRegexPart SQL Injection Affected: before 6.5.0; 6.5.0; 6.5.0; 6.5.0; 7.0.0; 7.0.0; +17 more |
| CVE-2022-24760 | 10.0 | Mar 11 | Command Injection in Parse server Affected: before 4.10.7 |
| CVE-2026-32248 | 9.8 | Mar 12 | Parse Server: Account takeover via operator injection in authentication data identifier Affected: before 8.6.38; 9.0.0 before 9.6.0; 9.6.0; 9.6.0; 9.6.0; 9.6.0; +7 more |
| CVE-2026-31871 | 9.8 | Mar 11 | Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL Affected: before 8.6.31; 9.0.0 before 9.6.0; 9.6.0; 9.6.0; 9.6.0; 9.6.0 |
| CVE-2026-31856 | 9.8 | Mar 11 | Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL Affected: before 8.6.29; 9.0.0 before 9.6.0; 9.6.0; 9.6.0 |
| CVE-2026-31840 | 9.8 | Mar 11 | Parse Server has a SQL injection via dot-notation field name in PostgreSQL Affected: before 8.6.28; 9.0.0 before 9.6.0; 9.6.0 |
| CVE-2026-30863 | 9.8 | Mar 7 | Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters Affected: before 8.6.10; 9.0.0 before 9.5.0; 9.5.0; 9.5.0; 9.5.0; 9.5.0; +6 more |
| CVE-2025-67727 | 9.8 | Dec 12 | Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management Affected: through 8.5.0; 8.6.0 |
| CVE-2023-36475 | 9.8 | Jun 28 | Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution Affected: before 5.5.2; 6.0.0 before 6.2.1 |
| CVE-2022-41878 | 9.8 | Nov 10 | Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers Affected: before 4.10.19; 5.0.0 before 5.3.2 |
| CVE-2022-39396 | 9.8 | Nov 10 | Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser Affected: before 4.10.18; 5.0.0 before 5.3.1 |
| CVE-2022-41879 | 9.8 | Nov 10 | Parse Server subject to Prototype pollution via Cloud Code Webhooks Affected: before 4.10.20; 5.0.0 before 5.3.3 |
| CVE-2026-34532 | 9.1 | Mar 31 | Parse Server: Cloud function validator bypass via prototype chain traversal Affected: before 8.6.67; 9.0.0 before 9.7.0; 9.7.0; 9.7.0; 9.7.0; 9.7.0; +6 more |
| CVE-2026-33409 | 9.1 | Mar 24 | Parse Server: Auth provider validation bypass on login via partial authData Affected: before 8.6.52; 9.0.0 before 9.6.0; 9.6.0; 9.6.0; 9.6.0; 9.6.0; +34 more |
| CVE-2026-31800 | 9.1 | Mar 10 | Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes Affected: before 8.6.25; 9.0.0 before 9.5.2; 9.5.2; 9.5.2; 9.5.2; 9.5.2; +7 more |
| CVE-2026-30965 | 9.1 | Mar 10 | Parse Server session token exfiltration via `redirectClassNameForKey` query parameter Affected: before 8.6.21; 9.0.0 before 9.5.2; 9.5.2; 9.5.2; 9.5.2; 9.5.2; +3 more |
| CVE-2026-27804 | 9.1 | Feb 25 | Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter Affected: before 8.6.3; 9.0.0 before 9.3.1; 9.3.1; 9.3.1; 9.3.1 |
| CVE-2024-29027 | 9.0 | Mar 19 | Parse Server crash and RCE via invalid Cloud Function or Cloud Job name Affected: before 6.5.5; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +23 more |
Showing 19