parse-server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-30229Highparse-server: parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as…CVE-2026-30228Mediumparse-server: parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction CVE-2026-29182Highparse-server: Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction CVE-2026-27804Criticalparse-server: Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter CVE-2025-68150Highparse-server: Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter CVE-2025-68115Mediumparse-server: Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template…CVE-2025-64502Mediumparse-server: Parse Server allows public `explain` queries which may expose sensitive database performance…CVE-2025-64430Highparse-server: Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format CVE-2025-53364Mediumparse-server: Parse Server exposes the data schema via GraphQL API CVE-2025-30168Mediumparse-server: Parse Server has an OAuth login vulnerability CVE-2024-47183Highparse-server: Parse Server's custom object ID allows to acquire role privileges CVE-2024-39309Criticalparse-server: ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability CVE-2024-29027Criticalparse-server: Server crashes on invalid Cloud Function or Cloud Job name CVE-2024-27298Criticalparse-server: ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection CVE-2023-46119Highparse-server: Parse Server may crash when uploading file without extension CVE-2023-41058Highparse-server: Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer CVE-2023-36475Criticalparse-server: Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution CVE-2023-32689Mediumparse-server: Phishing attack vulnerability by uploading malicious HTML file CVE-2023-22474Highparse-server: Parse Server option `masterKeyIps` vulnerability to IP spoofing CVE-2022-41879Highparse-server: Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks CVE-2022-41878Highparse-server: Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers CVE-2022-39396Criticalparse-server: Remote code execution via MongoDB BSON parser through prototype pollution CVE-2022-39313Highparse-server: parse-server crashes when receiving file download request with invalid byte range CVE-2022-39231Lowparse-server: parse-server auth adapter app ID validation can be circumvented CVE-2022-39225Mediumparse-server: parse-server's session object properties can be updated by foreign user if object ID is known

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo