Vulnerabilities in parse-community

127 results
Vexday analysis

Com 119 CVEs catalogadas e 18 classificadas como críticas, o ecossistema parse-community apresenta uma superfície de ataque relevante, especialmente considerando que 21 vulnerabilidades surgiram nos últimos 90 dias — sinal de atividade recente de descoberta. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero registros no CISA KEV, o que reduz a urgência imediata, mas não elimina o risco: o CVE-2022-24760 concentra o maior score EPSS observado (0,4908), indicando probabilidade não trivial de exploração. O tipo de falha mais recorrente é CWE-863 (Incorrect Authorization), sugerindo que controles de autorização inadequados são um padrão estrutural a ser endereçado em revisões de código e configuração. A presença de 2 CVEs com PoC pública reforça a necessidade de priorizar correções mesmo na ausência de exploração confirmada.

CVE-2026-61448LOWParse Server 9.0.0 Stored XSS via malformed Content-TypeEPSS 0.4%CVE-2025-62374MEDIUMParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsEPSS 0.4%CVE-2026-31840CRITICALParse Server has a SQL injection via dot-notation field name in PostgreSQLEPSS 0.4%CVE-2026-33538HIGHParse Server: Denial of service via unindexed database query for unconfigured auth providersEPSS 0.4%CVE-2025-30168MEDIUMParse Server has an OAuth login vulnerabilityEPSS 0.4%CVE-2026-33421HIGHParse Server: LiveQuery bypasses CLP pointer permission enforcementEPSS 0.4%CVE-2026-30938MEDIUMParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementEPSS 0.4%CVE-2026-30229HIGHParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any userEPSS 0.4%CVE-2026-30966CRITICALParse Server role escalation and CLP bypass via direct `_Join` table writeEPSS 0.4%CVE-2026-29182HIGHParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionEPSS 0.4%CVE-2026-34784HIGHParse Server: Streaming file download bypasses afterFind file trigger authorizationEPSS 0.4%CVE-2026-33627HIGHParse Server: Auth data exposed via /users/me endpointEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2026-31872HIGHParse Server has a protected fields bypass via dot-notation in query and sortEPSS 0.4%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.3%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.3%CVE-2026-50008MEDIUMParse Server: Server option routeAllowList is bypassable through batch sub-requestsEPSS 0.3%CVE-2026-32594MEDIUMParse Server GraphQL WebSocket endpoint bypasses security middlewareEPSS 0.3%CVE-2026-30972MEDIUMParse Server has a rate limit bypass via batch request endpointEPSS 0.3%CVE-2026-27610HIGHParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsEPSS 0.3%