Vulnerabilities

Filters

2 selected

102 records

Sort

Vendor: parse-community Component: Parse-server Clear all filters

TI-2021-22599 CVE-2021-47986 · GHSA-g938-h978-wf7v

Parse Server - Unreviewed Code Execution via Malicious Version Tags

LOW 35

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.0018 Published 2026-06-25 Fixed in 4.10.0 CWE-494

TI-2026-31990 CVE-2026-43930 · GHSA-jpq4-7fmq-q5fj

Parse Server: MFA SMS one-time password accepted twice under concurrent login

LOW 11

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00236 Published 2026-05-12 Fixed in 9.9.0-alpha.2, 8.6.76 CWE-362

TI-2026-28366 CVE-2026-39381 · GHSA-g4v2-qx3q-4p64

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

LOW 23

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.002 Published 2026-04-07 Fixed in 9.8.0-alpha.7, 8.6.75 CWE-863

TI-2026-28310 CVE-2026-39321 · GHSA-mmpq-5hcv-hf2v

Parse Server has a login timing side-channel reveals user existence

LOW 28

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00239 Published 2026-04-07 Fixed in 9.8.0-alpha.6, 8.6.74 CWE-208

TI-2026-27353 CVE-2026-35200 · GHSA-vr5f-2r24-w5hc

Parse Server has a file upload Content-Type override via extension mismatch

LOW 10

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00168 Published 2026-04-06 Fixed in 9.7.1-alpha.4, 8.6.73 CWE-436

TI-2026-27028 CVE-2026-34784 · GHSA-hpm8-9qx6-jvwv

Parse Server: Streaming file download bypasses afterFind file trigger authorization

LOW 36

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00393 Published 2026-03-31 Fixed in 8.6.71, 9.7.1-alpha.1 CWE-285

TI-2026-26510 CVE-2026-34215 · GHSA-wp76-gg32-8258

Parse Server: Auth data exposed via verify password endpoint

LOW 35

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00314 Published 2026-03-31 Fixed in 8.6.63, 9.7.0-alpha.7 CWE-200

TI-2026-26842 CVE-2026-34595 · GHSA-mmg8-87c5-jrc2

Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

LOW 24

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00261 Published 2026-03-31 Fixed in 8.6.70, 9.7.0-alpha.18 +1 CWE-843

TI-2026-26823 CVE-2026-34574 · GHSA-f6j3-w9v3-cq22

Parse Server: Session field immutability bypass via falsy-value guard

LOW 29

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-03-31 Fixed in 8.6.69, 9.7.0-alpha.14 CWE-697

TI-2026-26822 CVE-2026-34573 · GHSA-mfj6-6p54-m98c

Parse Server: GraphQL complexity validator exponential fragment traversal DoS

LOW 37

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00643 Published 2026-03-31 Fixed in 8.6.68, 9.7.0-alpha.12 CWE-407

TI-2026-26781 CVE-2026-34532 · GHSA-vpj2-qq7w-5qq6

Parse Server: Cloud function validator bypass via prototype chain traversal

MEDIUM 41

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00282 Published 2026-03-31 Fixed in 8.6.67, 9.7.0-alpha.11 CWE-863

TI-2026-26659 CVE-2026-34373 · GHSA-q3p6-g7c4-829c

Parse Server: GraphQL API endpoint ignores CORS origin restriction

LOW 23

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00205 Published 2026-03-31 Fixed in 8.6.66, 9.7.0-alpha.10 CWE-346

TI-2026-26649 CVE-2026-34363 · GHSA-m983-v2ff-wq65

Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

LOW 36

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00373 Published 2026-03-31 Fixed in 8.6.65, 9.7.0-alpha.9 CWE-362

TI-2026-26519 CVE-2026-34224 · GHSA-w73w-g5xw-rwhf

Parse Server: MFA single-use token bypass via concurrent authData login requests

LOW 11

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00317 Published 2026-03-31 Fixed in 8.6.64, 9.7.0-alpha.8 CWE-367

TI-2026-26009 CVE-2026-33627 · GHSA-37mj-c2wf-cx96

Parse Server: Auth data exposed via /users/me endpoint

LOW 37

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00393 Published 2026-03-24 Fixed in 8.6.61, 9.6.0-alpha.55 CWE-200

TI-2026-26006 CVE-2026-33624 · GHSA-2299-ghjr-6vjp

Parse Server: MFA recovery code single-use bypass via concurrent requests

LOW 10

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00182 Published 2026-03-24 Fixed in 8.6.60, 9.6.0-alpha.54 CWE-367

TI-2026-25932 CVE-2026-33539 · GHSA-p2w6-rmh7-w8q3

Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

MEDIUM 40

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0047 Published 2026-03-24 Fixed in 8.6.59, 9.6.0-alpha.53 CWE-89

TI-2026-25931 CVE-2026-33538 · GHSA-g4cf-xj29-wqqr

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00422 Published 2026-03-24 Fixed in 8.6.58, 9.6.0-alpha.52 CWE-400

TI-2026-25920 CVE-2026-33527 · GHSA-jc39-686j-wp6q

Parse Server: Session update endpoint allows overwriting server-generated session fields

LOW 30

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00265 Published 2026-03-24 Fixed in 8.6.57, 9.6.0-alpha.48 CWE-863

TI-2026-25904 CVE-2026-33508 · GHSA-6qh5-m6g3-xhq6

Parse Server: LiveQuery subscription query depth bypass

LOW 36

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00354 Published 2026-03-24 Fixed in 8.6.56, 9.6.0-alpha.45 CWE-674

TI-2026-25894 CVE-2026-33498 · GHSA-9fjp-q3c4-6w3j

Parse Server: Query condition depth bypass via pre-validation transform pipeline

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0047 Published 2026-03-24 Fixed in 8.6.55, 9.6.0-alpha.44 CWE-674

TI-2026-25826 CVE-2026-33429 · GHSA-qpc3-fg4j-8hgm

Parse Server: Protected field change detection oracle via LiveQuery watch parameter

LOW 34

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00329 Published 2026-03-24 Fixed in 8.6.54, 9.6.0-alpha.43 CWE-203

TI-2026-25818 CVE-2026-33421 · GHSA-fph2-r4qg-9576

Parse Server: LiveQuery bypasses CLP pointer permission enforcement

LOW 31

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00412 Published 2026-03-24 Fixed in 8.6.53, 9.6.0-alpha.42 CWE-863

TI-2026-25806 CVE-2026-33409 · GHSA-pfj7-wv7c-22pr

Parse Server: Auth provider validation bypass on login via partial authData

LOW 33

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 7.0 Network High privileges User interaction EPSS 0.00473 Published 2026-03-24 Fixed in 8.6.52, 9.6.0-alpha.41 CWE-287

TI-2026-25734 CVE-2026-33323 · GHSA-h29g-q5c2-9h4f

Parse Server: Email verification resend page leaks user existence

LOW 28

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00335 Published 2026-03-24 Fixed in 8.6.51, 9.6.0-alpha.40 CWE-204