Parse-Server
Parseplatform · 102 CVEs
Parse Server - Unreviewed Code Execution via Malicious Version Tags
Jun 25, 2026
Parse Server: MFA SMS one-time password accepted twice under concurrent login
May 12, 2026
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Apr 7, 2026
Parse Server has a login timing side-channel reveals user existence
Apr 7, 2026
Parse Server has a file upload Content-Type override via extension mismatch
Apr 6, 2026
Parse Server: Streaming file download bypasses afterFind file trigger authorization
Mar 31, 2026
Parse Server: Auth data exposed via verify password endpoint
Mar 31, 2026
Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value
Mar 31, 2026
Parse Server: Session field immutability bypass via falsy-value guard
Mar 31, 2026
Parse Server: GraphQL complexity validator exponential fragment traversal DoS
Mar 31, 2026
Parse Server: Cloud function validator bypass via prototype chain traversal
Mar 31, 2026
Parse Server: GraphQL API endpoint ignores CORS origin restriction
Mar 31, 2026
Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers
Mar 31, 2026
Parse Server: MFA single-use token bypass via concurrent authData login requests
Mar 31, 2026
Parse Server: Auth data exposed via /users/me endpoint
Mar 24, 2026
Parse Server: MFA recovery code single-use bypass via concurrent requests
Mar 24, 2026
Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
Mar 24, 2026
Parse Server: Denial of service via unindexed database query for unconfigured auth providers
Mar 24, 2026
Parse Server: Session update endpoint allows overwriting server-generated session fields
Mar 24, 2026
Parse Server: LiveQuery subscription query depth bypass
Mar 24, 2026
Parse Server: Query condition depth bypass via pre-validation transform pipeline
Mar 24, 2026
Parse Server: Protected field change detection oracle via LiveQuery watch parameter
Mar 24, 2026
Parse Server: LiveQuery bypasses CLP pointer permission enforcement
Mar 24, 2026
Parse Server: Auth provider validation bypass on login via partial authData
Mar 24, 2026
Parse Server: Email verification resend page leaks user existence
Mar 24, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2021-47986 | Parse Server - Unreviewed Code Execution via Malicious Version Tags | HIGH | 0.18% | Jun 25, 2026 |
| CVE-2026-43930 | Parse Server: MFA SMS one-time password accepted twice under concurrent login | LOW | 0.30% | May 12, 2026 |
| CVE-2026-39381 | Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` | MEDIUM | 0.32% | Apr 7, 2026 |
| CVE-2026-39321 | Parse Server has a login timing side-channel reveals user existence | MEDIUM | 0.37% | Apr 7, 2026 |
| CVE-2026-35200 | Parse Server has a file upload Content-Type override via extension mismatch | LOW | 0.28% | Apr 6, 2026 |
| CVE-2026-34784 | Parse Server: Streaming file download bypasses afterFind file trigger authorization | HIGH | 0.47% | Mar 31, 2026 |
| CVE-2026-34215 | Parse Server: Auth data exposed via verify password endpoint | HIGH | 0.53% | Mar 31, 2026 |
| CVE-2026-34595 | Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value | MEDIUM | 0.43% | Mar 31, 2026 |
| CVE-2026-34574 | Parse Server: Session field immutability bypass via falsy-value guard | MEDIUM | 0.34% | Mar 31, 2026 |
| CVE-2026-34573 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS | HIGH | 0.86% | Mar 31, 2026 |
| CVE-2026-34532 | Parse Server: Cloud function validator bypass via prototype chain traversal | CRITICAL | 0.49% | Mar 31, 2026 |
| CVE-2026-34373 | Parse Server: GraphQL API endpoint ignores CORS origin restriction | MEDIUM | 0.24% | Mar 31, 2026 |
| CVE-2026-34363 | Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers | HIGH | 0.40% | Mar 31, 2026 |
| CVE-2026-34224 | Parse Server: MFA single-use token bypass via concurrent authData login requests | LOW | 0.34% | Mar 31, 2026 |
| CVE-2026-33627 | Parse Server: Auth data exposed via /users/me endpoint | HIGH | 0.53% | Mar 24, 2026 |
| CVE-2026-33624 | Parse Server: MFA recovery code single-use bypass via concurrent requests | LOW | 0.29% | Mar 24, 2026 |
| CVE-2026-33539 | Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter | HIGH | 0.67% | Mar 24, 2026 |
| CVE-2026-33538 | Parse Server: Denial of service via unindexed database query for unconfigured auth providers | HIGH | 0.75% | Mar 24, 2026 |
| CVE-2026-33527 | Parse Server: Session update endpoint allows overwriting server-generated session fields | MEDIUM | 0.34% | Mar 24, 2026 |
| CVE-2026-33508 | Parse Server: LiveQuery subscription query depth bypass | HIGH | 0.62% | Mar 24, 2026 |
| CVE-2026-33498 | Parse Server: Query condition depth bypass via pre-validation transform pipeline | HIGH | 0.62% | Mar 24, 2026 |
| CVE-2026-33429 | Parse Server: Protected field change detection oracle via LiveQuery watch parameter | MEDIUM | 0.41% | Mar 24, 2026 |
| CVE-2026-33421 | Parse Server: LiveQuery bypasses CLP pointer permission enforcement | HIGH | 0.44% | Mar 24, 2026 |
| CVE-2026-33409 | Parse Server: Auth provider validation bypass on login via partial authData | HIGH | 0.56% | Mar 24, 2026 |
| CVE-2026-33323 | Parse Server: Email verification resend page leaks user existence | MEDIUM | 0.43% | Mar 24, 2026 |
Showing 1 to 25 of 102 CVEs