parse-server
- Software type
- Other
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, parse-server recorded 31 security vulnerabilities in the last 90 days, of which 11 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of parse-server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-30948Parse Server has stored cross-site scripting (XSS) via SVG file uploadCVE-2026-30947Parse Server ha a bypass of class-level permissions in LiveQueryCVE-2026-30946Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APICVE-2026-30941Parse Server has a NoSQL injection via token type in password reset and email verification endpointsCVE-2026-30939Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-30948Parse Server has stored cross-site scripting (XSS) via SVG file upload | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-30947Parse Server ha a bypass of class-level permissions in LiveQuery | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30946Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30941Parse Server has a NoSQL injection via token type in password reset and email verification endpoints | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30939Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-30938Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityMedium |
|---|
CVE-2026-30925Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery | Exploitation statusNot exploited | FixYes | Published03/09/2026 | SeverityHigh |
|---|
CVE-2026-30863Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters | Exploitation statusNot exploited | FixYes | Published03/07/2026 | SeverityCritical |
|---|
CVE-2026-30854Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled | Exploitation statusNot exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30850Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization | Exploitation statusNot exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30848Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory | Exploitation statusNot exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
CVE-2026-30835Parse Server: Malformed `$regex` query leaks database error details in API response | Exploitation statusNot exploited | FixYes | Published03/06/2026 | SeverityMedium |
|---|
CVE-2026-30229Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user | Exploitation statusNot exploited | FixYes | Published03/06/2026 | SeverityHigh |
|---|
CVE-2026-30228Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction | Exploitation statusNot exploited | FixYes | Published03/06/2026 | SeverityMedium |
|---|
CVE-2026-29182Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction | Exploitation statusNot exploited | FixYes | Published03/06/2026 | SeverityHigh |
|---|
CVE-2026-27804Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter | Exploitation statusNot exploited | FixNo | Published02/25/2026 | SeverityCritical |
|---|
CVE-2025-68150Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter | Exploitation statusNot exploited | FixYes | Published12/16/2025 | SeverityHigh |
|---|
CVE-2025-68115Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables | Exploitation statusNot exploited | FixNo | Published12/16/2025 | SeverityMedium |
|---|
CVE-2025-67727Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management | Exploitation statusNot exploited | FixNo | Published12/12/2025 | SeverityMedium |
|---|
CVE-2025-64502Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details | Exploitation statusNot exploited | FixNo | Published11/10/2025 | SeverityMedium |
|---|
CVE-2025-64430Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityHigh |
|---|
CVE-2025-53364Parse Server exposes the data schema via GraphQL API | Exploitation statusNot exploited | FixYes | Published07/10/2025 | SeverityMedium |
|---|
CVE-2025-30168Parse Server has an OAuth login vulnerability | Exploitation statusNot exploited | FixYes | Published03/21/2025 | SeverityMedium |
|---|
CVE-2024-47183Parse Server's custom object ID allows to acquire role privileges | Exploitation statusActively exploited | FixYes | Published10/04/2024 | SeverityHigh |
|---|
CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability | Exploitation statusNot exploited | FixNo | Published07/01/2024 | SeverityCritical |
|---|
CVE-2024-29027Parse Server crash and RCE via invalid Cloud Function or Cloud Job name | Exploitation statusNot exploited | FixNo | Published03/19/2024 | SeverityCritical |
|---|
CVE-2024-27298Parse Server literalizeRegexPart SQL Injection | Exploitation statusActively exploited | FixYes | Published03/01/2024 | SeverityCritical |
|---|
CVE-2023-46119Parse Server may crash when uploading file without extension | Exploitation statusNot exploited | FixYes | Published10/25/2023 | SeverityHigh |
|---|
CVE-2023-41058Trigger `beforeFind` not invoked in internal query pipeline in parse-server | Exploitation statusNot exploited | FixYes | Published09/04/2023 | SeverityHigh |
|---|
CVE-2023-36475Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution | Exploitation statusNot exploited | FixYes | Published06/28/2023 | SeverityCritical |
|---|
CVE-2023-32689Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file | Exploitation statusNot exploited | FixNo | Published05/30/2023 | SeverityMedium |
|---|
CVE-2023-22474Parse Server is vulnerable to authentication bypass via spoofing | Exploitation statusNot exploited | FixYes | Published02/03/2023 | SeverityHigh |
|---|
CVE-2022-41879Parse Server subject to Prototype pollution via Cloud Code Webhooks | Exploitation statusNot exploited | FixYes | Published11/10/2022 | SeverityHigh |
|---|
CVE-2022-41878Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers | Exploitation statusNot exploited | FixYes | Published11/10/2022 | SeverityHigh |
|---|
CVE-2022-39396Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser | Exploitation statusNot exploited | FixYes | Published11/10/2022 | SeverityCritical |
|---|
CVE-2022-39313Parse Server crashes when receiving file download request with invalid byte range | Exploitation statusNot exploited | FixYes | Published10/24/2022 | SeverityHigh |
|---|
CVE-2022-39231Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented | Exploitation statusNot exploited | FixYes | Published09/23/2022 | SeverityLow |
|---|
CVE-2022-39225Parse Server subject to Incorrect Resource Transfer Between Spheres | Exploitation statusNot exploited | FixYes | Published09/23/2022 | SeverityMedium |
|---|
CVE-2022-36079Parse Server vulnerable to brute force guessing of user sensitive data via search patterns | Exploitation statusNot exploited | FixNo | Published09/07/2022 | SeverityHigh |
|---|
CVE-2022-31112Protected fields exposed via LiveQuery in parse-server | Exploitation statusNot exploited | FixNo | Published06/30/2022 | SeverityHigh |
|---|
CVE-2022-31089Invalid file request can crashe parse-server | Exploitation statusNot exploited | FixNo | Published06/27/2022 | SeverityHigh |
|---|
CVE-2022-31083Authentication bypass in Parse Server Apple Game Center auth adapter | Exploitation statusNot exploited | FixNo | Published06/17/2022 | SeverityHigh |
|---|
CVE-2022-24901Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter | Exploitation statusNot exploited | FixYes | Published05/04/2022 | SeverityHigh |
|---|
CVE-2022-24760Command Injection in Parse server | Exploitation statusActively exploited | FixNo | Published03/11/2022 | SeverityCritical |
|---|
CVE-2021-41109LiveQuery publishes user session tokens | Exploitation statusNot confirmed | FixNo | Published09/30/2021 | SeverityHigh |
|---|
CVE-2021-39187Crash server with query parameter | Exploitation statusNot confirmed | FixNo | Published09/02/2021 | SeverityHigh |
|---|
CVE-2021-39138New anonymous user session acts as if it's created with password | Exploitation statusNot confirmed | FixYes | Published08/18/2021 | SeverityMedium |
|---|
CVE-2020-26288Parse Server stores password in plain text | Exploitation statusNot confirmed | FixYes | Published12/30/2020 | SeverityHigh |
|---|
CVE-2020-15270Improper session expiration in Parse Server | Exploitation statusNot confirmed | FixNo | Published10/22/2020 | SeverityMedium |
|---|
CVE-2020-15126Information disclosure through Viewer query in parse-server | Exploitation statusNot confirmed | FixNo | Published07/22/2020 | SeverityMedium |
|---|
151 Results | Page 3 of 4