parse-server
- Software type
- Other
- Total vulnerabilities (90 days)
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, parse-server recorded 31 security vulnerabilities in the last 90 days, of which 11 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of parse-server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-34784Parse Server: Streaming file download bypasses afterFind file trigger authorizationCVE-2026-34595Parse Server: LiveQuery protected-field guard bypass via array-like logical operator valueCVE-2026-34574Parse Server: Session field immutability bypass via falsy-value guardCVE-2026-34573Parse Server: GraphQL complexity validator exponential fragment traversal DoSCVE-2026-34532Parse Server: Cloud function validator bypass via prototype chain traversal| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-34784Parse Server: Streaming file download bypasses afterFind file trigger authorization | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-34595Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityMedium |
|---|
CVE-2026-34574Parse Server: Session field immutability bypass via falsy-value guard | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityMedium |
|---|
CVE-2026-34573Parse Server: GraphQL complexity validator exponential fragment traversal DoS | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityHigh |
|---|
CVE-2026-34532Parse Server: Cloud function validator bypass via prototype chain traversal | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityCritical |
|---|
CVE-2026-34373Parse Server: GraphQL API endpoint ignores CORS origin restriction | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityMedium |
|---|
CVE-2026-34363Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityHigh |
|---|
CVE-2026-34224Parse Server: MFA single-use token bypass via concurrent authData login requests | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityLow |
|---|
CVE-2026-34215Parse Server: Auth data exposed via verify password endpoint | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityHigh |
|---|
CVE-2026-33627Parse Server: Auth data exposed via /users/me endpoint | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33624Parse Server: MFA recovery code single-use bypass via concurrent requests | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33539Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33538Parse Server: Denial of service via unindexed database query for unconfigured auth providers | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33527Parse Server: Session update endpoint allows overwriting server-generated session fields | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33508Parse Server: LiveQuery subscription query depth bypass | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33498Parse Server: Query condition depth bypass via pre-validation transform pipeline | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33429Parse Server: Protected field change detection oracle via LiveQuery watch parameter | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33421Parse Server: LiveQuery bypasses CLP pointer permission enforcement | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33409Parse Server: Auth provider validation bypass on login via partial authData | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33323Parse Server: Email verification resend page leaks user existence | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33163Parse Server leaks protected fields via LiveQuery afterEvent trigger | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityHigh |
|---|
CVE-2026-33042Parse Server affected by empty authData bypassing credential requirement on signup | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityMedium |
|---|
CVE-2026-32944Parse Server crash via deeply nested query condition operators | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityHigh |
|---|
CVE-2026-32943Parse Server has a password reset token single-use bypass via concurrent requests | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityLow |
|---|
CVE-2026-32886Parse Server's Cloud function dispatch crashes server via prototype chain traversal | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityHigh |
|---|
CVE-2026-32878Parse Server vulnerable to schema poisoning via prototype pollution in deep copy | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityMedium |
|---|
CVE-2026-32770Parse Server: LiveQuery subscription with invalid regular expression crashes server | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityMedium |
|---|
CVE-2026-32742Parse Server session creation endpoint allows overwriting server-generated session fields | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityMedium |
|---|
CVE-2026-32728Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries | Exploitation statusNot exploited | FixNo | Published03/18/2026 | SeverityHigh |
|---|
CVE-2026-32594Parse Server GraphQL WebSocket endpoint bypasses security middleware | Exploitation statusNot exploited | FixYes | Published03/13/2026 | SeverityMedium |
|---|
CVE-2026-32269Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint | Exploitation statusNot exploited | FixYes | Published03/12/2026 | SeverityMedium |
|---|
CVE-2026-32248Parse Server: Account takeover via operator injection in authentication data identifier | Exploitation statusNot exploited | FixYes | Published03/12/2026 | SeverityCritical |
|---|
CVE-2026-32242Parse Server OAuth2 adapter shares mutable state across providers via singleton instance | Exploitation statusNot exploited | FixYes | Published03/12/2026 | SeverityCritical |
|---|
CVE-2026-32234Parse Server has a SQL injection via query field name when using PostgreSQL | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-32098Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-31901Parse Server has user enumeration via email verification endpoint | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-31875Parse Server MFA recovery codes not consumed after use | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityHigh |
|---|
CVE-2026-31872Parse Server has a protected fields bypass via dot-notation in query and sort | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityHigh |
|---|
CVE-2026-31871Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityCritical |
|---|
CVE-2026-31868Parse Server has Stored XSS via file upload of HTML-renderable file types | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-31856Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityCritical |
|---|
CVE-2026-31840Parse Server has a SQL injection via dot-notation field name in PostgreSQL | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityCritical |
|---|
CVE-2026-31828Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityMedium |
|---|
CVE-2026-31800Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30972Parse Server has a rate limit bypass via batch request endpoint | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityMedium |
|---|
CVE-2026-30967Parse Server OAuth2 authentication adapter account takeover via identity spoofing | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30966Parse Server role escalation and CLP bypass via direct `_Join` table write | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityCritical |
|---|
CVE-2026-30965Parse Server session token exfiltration via `redirectClassNameForKey` query parameter | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityCritical |
|---|
CVE-2026-30962Parse Server has a protected fields bypass via logical query operators | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30949Parse Server is missing audience validation in Keycloak authentication adapter | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
151 Results | Page 2 of 4