Vulnerabilities in parse-community
156 resultsCVE-2026-27610HIGHParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsEPSS 0.4%CVE-2026-116162LOWParse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA LoginEPSS 0.4%CVE-2026-31800HIGHParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesEPSS 0.4%CVE-2026-119569MEDIUMParse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of ServiceEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2026-30835MEDIUMParse Server: Malformed `$regex` query leaks database error details in API responseEPSS 0.4%CVE-2026-121415MEDIUMParse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation KeyEPSS 0.4%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.4%CVE-2026-32594MEDIUMParse Server GraphQL WebSocket endpoint bypasses security middlewareEPSS 0.4%CVE-2026-30228MEDIUMParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionEPSS 0.4%CVE-2026-100631HIGHParse Server 9.0.0 Unauthenticated Installation Deletion via Operator InjectionEPSS 0.4%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.4%CVE-2026-109301HIGHParse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URLEPSS 0.3%CVE-2026-30848MEDIUMParse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryEPSS 0.3%CVE-2026-30962HIGHParse Server has a protected fields bypass via logical query operatorsEPSS 0.3%CVE-2026-116164MEDIUMParse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object WritesEPSS 0.3%CVE-2026-50008MEDIUMParse Server: Server option routeAllowList is bypassable through batch sub-requestsEPSS 0.3%CVE-2026-33323MEDIUMParse Server: Email verification resend page leaks user existenceEPSS 0.3%CVE-2026-121414HIGHParse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer UpdateEPSS 0.3%CVE-2026-33429MEDIUMParse Server: Protected field change detection oracle via LiveQuery watch parameterEPSS 0.3%