Vulnerabilities in parse-community
156 resultsCVE-2026-33163HIGHParse Server leaks protected fields via LiveQuery afterEvent triggerEPSS 0.4%CVE-2025-64502MEDIUMParse Server allows public `explain` queries which may expose sensitive database performance information and schema detailsEPSS 0.4%CVE-2026-66009MEDIUMParse Server 9.0.0 Information Disclosure via GraphQL Error MessagesEPSS 0.4%CVE-2026-30966CRITICALParse Server role escalation and CLP bypass via direct `_Join` table writeEPSS 0.4%CVE-2026-30229HIGHParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any userEPSS 0.4%CVE-2026-29182HIGHParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionEPSS 0.4%CVE-2026-33538HIGHParse Server: Denial of service via unindexed database query for unconfigured auth providersEPSS 0.4%CVE-2025-67727MEDIUMParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege ManagementEPSS 0.4%CVE-2025-62374MEDIUMParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsEPSS 0.4%CVE-2026-31872HIGHParse Server has a protected fields bypass via dot-notation in query and sortEPSS 0.4%CVE-2024-47183HIGHParse Server's custom object ID allows to acquire role privilegesEPSS 0.4%CVE-2026-61448LOWParse Server 9.0.0 Stored XSS via malformed Content-TypeEPSS 0.4%CVE-2026-121965MEDIUMParse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation KeyEPSS 0.4%CVE-2026-33421HIGHParse Server: LiveQuery bypasses CLP pointer permission enforcementEPSS 0.4%CVE-2025-30168MEDIUMParse Server has an OAuth login vulnerabilityEPSS 0.4%CVE-2026-112768MEDIUMParse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User UpdateEPSS 0.4%CVE-2026-30972MEDIUMParse Server has a rate limit bypass via batch request endpointEPSS 0.4%CVE-2026-34784HIGHParse Server: Streaming file download bypasses afterFind file trigger authorizationEPSS 0.4%CVE-2026-33627HIGHParse Server: Auth data exposed via /users/me endpointEPSS 0.4%CVE-2026-30967HIGHParse Server OAuth2 authentication adapter account takeover via identity spoofingEPSS 0.4%