Parseplatform - vulnerabilities (CVEs)

132 CVEs in 5 products, 14 in the last 30 days, newest from 2026-10-26.

Products

Newest CVEs of Parseplatform

CVE-2026-116801 - CVSS 5.3 (medium), 2026-10-26: Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query…
CVE-2026-116165 - CVSS 8.8 (high), 2026-10-25: Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without…
CVE-2026-116164 - CVSS 6.3 (medium), 2026-10-25: Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store…
CVE-2026-116163 - CVSS 9.1 (critical), 2026-10-25: Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate…
CVE-2026-116162 - CVSS 2.1 (low), 2026-10-25: Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor…
CVE-2026-116161 - CVSS 6 (medium), 2026-10-25: Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits…
CVE-2026-112769 - CVSS 2.3 (low), 2026-10-19: Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when…
CVE-2026-112768 - CVSS 6.9 (medium), 2026-10-19: Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and…
CVE-2026-110854 - CVSS 8.2 (high), 2026-10-14: Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the…
CVE-2026-109954 - CVSS 8.3 (high), 2026-10-13: Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's…
CVE-2026-109303 - CVSS 5.3 (medium), 2026-10-12: Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on…
CVE-2026-109302 - CVSS 6.3 (medium), 2026-10-12: Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a…
CVE-2026-109301 - CVSS 8.2 (high), 2026-10-12: Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and…
CVE-2026-105828 - CVSS 6.3 (medium), 2026-10-08: Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages…
CVE-2026-101042 - CVSS 7.4 (high), 2026-09-27: Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub,…
CVE-2026-100631 - CVSS 8.7 (high), 2026-09-26: Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication…
CVE-2026-100632 - CVSS 7.1 (high), 2026-09-26: Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields…
CVE-2026-87806 - CVSS 9.1 (critical), 2026-09-09: Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter…
CVE-2026-66009 - CVSS 6.3 (medium), 2026-07-24: Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input…
CVE-2026-66008 - CVSS 6.3 (medium), 2026-07-24: Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation…
CVE-2026-64627 - CVSS 6.9 (medium), 2026-07-21: Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted…
CVE-2026-61448 - CVSS 2.1 (low), 2026-07-11: Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's…
CVE-2021-47987 - CVSS 7.7 (high), 2026-06-25: Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an…
CVE-2021-47986 - CVSS 7.7 (high), 2026-06-25: Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a…
CVE-2026-43930 - CVSS 5.9 (medium), 2026-05-12: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in…
CVE-2026-39381 - CVSS 5.3 (medium), 2026-04-07: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET…
CVE-2026-39321 - CVSS 6.3 (medium), 2026-04-07: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint…
CVE-2026-35200 - CVSS 5.4 (medium), 2026-04-06: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be…
CVE-2026-34215 - CVSS 8.2 (high), 2026-03-31: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify…
CVE-2026-34784 - CVSS 8.2 (high), 2026-03-31: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file…