Parse-Server
Parse-Community · 124 CVEs
Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value
Mar 31, 2026
Parse Server: Session field immutability bypass via falsy-value guard
Mar 31, 2026
Parse Server: GraphQL complexity validator exponential fragment traversal DoS
Mar 31, 2026
Parse Server: Cloud function validator bypass via prototype chain traversal
Mar 31, 2026
Parse Server: GraphQL API endpoint ignores CORS origin restriction
Mar 31, 2026
Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers
Mar 31, 2026
Parse Server: MFA single-use token bypass via concurrent authData login requests
Mar 31, 2026
Parse Server: Auth data exposed via /users/me endpoint
Mar 24, 2026
Parse Server: MFA recovery code single-use bypass via concurrent requests
Mar 24, 2026
Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
Mar 24, 2026
Parse Server: Denial of service via unindexed database query for unconfigured auth providers
Mar 24, 2026
Parse Server: Session update endpoint allows overwriting server-generated session fields
Mar 24, 2026
Parse Server: LiveQuery subscription query depth bypass
Mar 24, 2026
Parse Server: Query condition depth bypass via pre-validation transform pipeline
Mar 24, 2026
Parse Server: Protected field change detection oracle via LiveQuery watch parameter
Mar 24, 2026
Parse Server: LiveQuery bypasses CLP pointer permission enforcement
Mar 24, 2026
Parse Server: Auth provider validation bypass on login via partial authData
Mar 24, 2026
Parse Server: Email verification resend page leaks user existence
Mar 24, 2026
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Mar 18, 2026
Parse Server affected by empty authData bypassing credential requirement on signup
Mar 18, 2026
Parse Server crash via deeply nested query condition operators
Mar 18, 2026
Parse Server has a password reset token single-use bypass via concurrent requests
Mar 18, 2026
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Mar 18, 2026
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
Mar 18, 2026
Parse Server: LiveQuery subscription with invalid regular expression crashes server
Mar 18, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-34595 | Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value | MEDIUM | 0.43% | Mar 31, 2026 |
| CVE-2026-34574 | Parse Server: Session field immutability bypass via falsy-value guard | MEDIUM | 0.34% | Mar 31, 2026 |
| CVE-2026-34573 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS | HIGH | 0.86% | Mar 31, 2026 |
| CVE-2026-34532 | Parse Server: Cloud function validator bypass via prototype chain traversal | CRITICAL | 0.49% | Mar 31, 2026 |
| CVE-2026-34373 | Parse Server: GraphQL API endpoint ignores CORS origin restriction | MEDIUM | 0.24% | Mar 31, 2026 |
| CVE-2026-34363 | Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers | HIGH | 0.40% | Mar 31, 2026 |
| CVE-2026-34224 | Parse Server: MFA single-use token bypass via concurrent authData login requests | LOW | 0.34% | Mar 31, 2026 |
| CVE-2026-33627 | Parse Server: Auth data exposed via /users/me endpoint | HIGH | 0.53% | Mar 24, 2026 |
| CVE-2026-33624 | Parse Server: MFA recovery code single-use bypass via concurrent requests | LOW | 0.29% | Mar 24, 2026 |
| CVE-2026-33539 | Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter | HIGH | 0.67% | Mar 24, 2026 |
| CVE-2026-33538 | Parse Server: Denial of service via unindexed database query for unconfigured auth providers | HIGH | 0.75% | Mar 24, 2026 |
| CVE-2026-33527 | Parse Server: Session update endpoint allows overwriting server-generated session fields | MEDIUM | 0.34% | Mar 24, 2026 |
| CVE-2026-33508 | Parse Server: LiveQuery subscription query depth bypass | HIGH | 0.62% | Mar 24, 2026 |
| CVE-2026-33498 | Parse Server: Query condition depth bypass via pre-validation transform pipeline | HIGH | 0.62% | Mar 24, 2026 |
| CVE-2026-33429 | Parse Server: Protected field change detection oracle via LiveQuery watch parameter | MEDIUM | 0.41% | Mar 24, 2026 |
| CVE-2026-33421 | Parse Server: LiveQuery bypasses CLP pointer permission enforcement | HIGH | 0.44% | Mar 24, 2026 |
| CVE-2026-33409 | Parse Server: Auth provider validation bypass on login via partial authData | HIGH | 0.56% | Mar 24, 2026 |
| CVE-2026-33323 | Parse Server: Email verification resend page leaks user existence | MEDIUM | 0.43% | Mar 24, 2026 |
| CVE-2026-33163 | Parse Server leaks protected fields via LiveQuery afterEvent trigger | HIGH | 0.50% | Mar 18, 2026 |
| CVE-2026-33042 | Parse Server affected by empty authData bypassing credential requirement on signup | MEDIUM | 0.37% | Mar 18, 2026 |
| CVE-2026-32944 | Parse Server crash via deeply nested query condition operators | HIGH | 0.61% | Mar 18, 2026 |
| CVE-2026-32943 | Parse Server has a password reset token single-use bypass via concurrent requests | LOW | 0.24% | Mar 18, 2026 |
| CVE-2026-32886 | Parse Server's Cloud function dispatch crashes server via prototype chain traversal | HIGH | 0.67% | Mar 18, 2026 |
| CVE-2026-32878 | Parse Server vulnerable to schema poisoning via prototype pollution in deep copy | MEDIUM | 0.47% | Mar 18, 2026 |
| CVE-2026-32770 | Parse Server: LiveQuery subscription with invalid regular expression crashes server | HIGH | 0.71% | Mar 18, 2026 |
Showing 26 to 50 of 124 CVEs