Vulnerabilities in parse-community

156 results
CVE-2026-32886HIGHParse Server's Cloud function dispatch crashes server via prototype chain traversalEPSS 0.5%CVE-2026-57481LOWParse Server: LiveQuery discloses object data to a subscriber across an ACL read-access changeEPSS 0.5%CVE-2022-39231LOWParse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventedEPSS 0.5%CVE-2026-30941HIGHParse Server has a NoSQL injection via token type in password reset and email verification endpointsEPSS 0.5%CVE-2026-32944HIGHParse Server crash via deeply nested query condition operatorsEPSS 0.5%CVE-2026-27595CRITICALParse Dashboard has incomplete authentication on AI Agent endpointEPSS 0.5%CVE-2026-87806CRITICALParse Server 9.0.0 Authentication Bypass via LDAP Empty PasswordEPSS 0.5%CVE-2026-30925HIGHParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryEPSS 0.5%CVE-2026-31828MEDIUMParse Server has an LDAP injection via unsanitized user input in DN and group filter constructionEPSS 0.5%CVE-2022-39225MEDIUMParse Server subject to Incorrect Resource Transfer Between SpheresEPSS 0.5%CVE-2026-30949HIGHParse Server is missing audience validation in Keycloak authentication adapterEPSS 0.5%CVE-2026-31856CRITICALParse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLEPSS 0.5%CVE-2026-31871CRITICALParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLEPSS 0.5%CVE-2026-31840CRITICALParse Server has a SQL injection via dot-notation field name in PostgreSQLEPSS 0.5%CVE-2026-33409HIGHParse Server: Auth provider validation bypass on login via partial authDataEPSS 0.5%CVE-2026-64627MEDIUMParse Server 9.0.0 Schema Disclosure via GraphQL Variable CoercionEPSS 0.5%CVE-2026-33498HIGHParse Server: Query condition depth bypass via pre-validation transform pipelineEPSS 0.5%CVE-2026-30947HIGHParse Server ha a bypass of class-level permissions in LiveQueryEPSS 0.5%CVE-2026-33539HIGHParse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapterEPSS 0.5%CVE-2026-30938MEDIUMParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementEPSS 0.5%