parse-server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-33538Highparse-server: Parse Server: Denial of Service via unindexed database query for unconfigured auth providers CVE-2026-33527Mediumparse-server: Parse Server's Session Update endpoint allows overwriting server-generated session fields CVE-2026-33508Highparse-server: Parse Server LiveQuery subscription query depth bypass CVE-2026-33498Highparse-server: Parse Server has a query condition depth bypass via pre-validation transform pipeline CVE-2026-33429Mediumparse-server: Parse Server has a protected field change detection oracle via LiveQuery watch parameter CVE-2026-33421Highparse-server: Parse Server's LiveQuery bypasses CLP pointer permission enforcement CVE-2026-33409Highparse-server: Parse Server has an auth provider validation bypass on login via partial authData CVE-2026-33323Mediumparse-server: Parse Server email verification resend page leaks user existence CVE-2026-33163Highparse-server: Parse Server leaks protected fields via LiveQuery afterEvent trigger CVE-2026-33042Mediumparse-server: Parse Server affected by empty authData bypassing credential requirement on signup CVE-2026-32770Mediumparse-server: Parse Server LiveQuery subscription with invalid regular expression crashes server CVE-2026-32742Mediumparse-server: Parse Server session creation endpoint allows overwriting server-generated session fields CVE-2026-32878Mediumparse-server: Parse Server vulnerable to schema poisoning via prototype pollution in deep copy CVE-2026-32886Highparse-server: Parse Server's Cloud function dispatch crashes server via prototype chain traversal CVE-2026-32943Lowparse-server: Parse Server has a password reset token single-use bypass via concurrent requests CVE-2026-32944Highparse-server: Parse Server crash via deeply nested query condition operators CVE-2026-32728Highparse-server: Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML…CVE-2026-32594Mediumparse-server: Parse Server's GraphQL WebSocket endpoint bypasses security middleware CVE-2026-32269Mediumparse-server: Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint CVE-2026-32248Criticalparse-server: Parse Server: Account takeover via operator injection in authentication data identifier CVE-2026-32242Criticalparse-server: Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance CVE-2026-32234Mediumparse-server: Parse Server has a SQL injection via query field name when using PostgreSQL CVE-2026-32098Mediumparse-server: Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause CVE-2026-31901Mediumparse-server: Parse Server vulnerable to user enumeration via email verification endpoint CVE-2026-31875Highparse-server: Parse Server's MFA recovery codes not consumed after use

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo