parse-server
- Software type
- Other
- Total vulnerabilities (90 days)
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, parse-server recorded 31 security vulnerabilities in the last 90 days, of which 11 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of parse-server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124425Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save ResponseCVE-2026-123487Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation RegexCVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create ResponseCVE-2026-121965Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation KeyCVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-124425Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response | Exploitation statusNot confirmed | FixYes |
| SeverityLow |
CVE-2026-123487Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex | Exploitation statusNot confirmed | FixYes | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response | Exploitation statusNot confirmed | FixYes | Published11/05/2026 | SeverityLow |
|---|
CVE-2026-121965Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key | Exploitation statusNot exploited | FixYes | Published11/04/2026 | SeverityMedium |
|---|
CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key | Exploitation statusNot confirmed | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update | Exploitation statusNot confirmed | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-121413Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityLow |
|---|
CVE-2026-120310Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response | Exploitation statusNot confirmed | FixYes | Published11/02/2026 | SeverityLow |
|---|
CVE-2026-119571Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-119570Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityLow |
|---|
CVE-2026-119569Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-119126Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys | Exploitation statusNot exploited | FixYes | Published10/29/2026 | SeverityLow |
|---|
CVE-2026-119125Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields | Exploitation statusNot exploited | FixYes | Published10/29/2026 | SeverityLow |
|---|
CVE-2026-116801Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query | Exploitation statusNot exploited | FixYes | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-116165Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB | Exploitation statusNot exploited | FixYes | Published10/25/2026 | SeverityHigh |
|---|
CVE-2026-116164Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes | Exploitation statusNot confirmed | FixYes | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-116163Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses | Exploitation statusNot exploited | FixYes | Published10/25/2026 | SeverityCritical |
|---|
CVE-2026-116162Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login | Exploitation statusNot exploited | FixYes | Published10/25/2026 | SeverityLow |
|---|
CVE-2026-116161Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions | Exploitation statusNot exploited | FixYes | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-112769Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityLow |
|---|
CVE-2026-112768Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update | Exploitation statusNot exploited | FixYes | Published10/19/2026 | SeverityMedium |
|---|
CVE-2026-110854Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-109954Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference | Exploitation statusNot exploited | FixYes | Published10/13/2026 | SeverityHigh |
|---|
CVE-2026-109303Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109302Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-105828Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors | Exploitation statusNot exploited | FixYes | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-101042Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity | Exploitation statusNot exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password | Exploitation statusNot exploited | FixYes | Published09/09/2026 | SeverityCritical |
|---|
CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages | Exploitation statusNot exploited | FixYes | Published07/24/2026 | SeverityMedium |
|---|
CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages | Exploitation statusNot exploited | FixYes | Published07/24/2026 | SeverityMedium |
|---|
CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion | Exploitation statusNot exploited | FixYes | Published07/21/2026 | SeverityMedium |
|---|
CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Type | Exploitation statusNot exploited | FixYes | Published07/11/2026 | SeverityLow |
|---|
CVE-2026-57481Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityLow |
|---|
CVE-2026-57480Parse Server: Denial of service via exponential-time processing of deeply nested query operators | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-55778Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityLow |
|---|
CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tags | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tags | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL | Exploitation statusNot exploited | FixYes | Published06/12/2026 | SeverityMedium |
|---|
CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied | Exploitation statusNot exploited | FixYes | Published06/12/2026 | SeverityMedium |
|---|
CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist | Exploitation statusNot exploited | FixYes | Published06/12/2026 | SeverityLow |
|---|
CVE-2026-50008Parse Server: Server option routeAllowList is bypassable through batch sub-requests | Exploitation statusNot exploited | FixYes | Published06/12/2026 | SeverityMedium |
|---|
CVE-2026-47248Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers | Exploitation statusNot exploited | FixYes | Published06/12/2026 | SeverityMedium |
|---|
CVE-2026-47138Parse Server: Pre-authentication denial of service via client version header regex backtracking | Exploitation statusNot exploited | FixYes | Published06/12/2026 | SeverityHigh |
|---|
CVE-2026-43930Parse Server: MFA SMS one-time password accepted twice under concurrent login | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityLow |
|---|
CVE-2026-39381Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityMedium |
|---|
CVE-2026-39321Parse Server has a login timing side-channel reveals user existence | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityMedium |
|---|
CVE-2026-35200Parse Server has a file upload Content-Type override via extension mismatch | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityLow |
|---|
151 Results | Page 1 of 4