Vulnerabilities in parse-community

127 results
Vexday analysis

Com 119 CVEs catalogadas e 18 classificadas como críticas, o ecossistema parse-community apresenta uma superfície de ataque relevante, especialmente considerando que 21 vulnerabilidades surgiram nos últimos 90 dias — sinal de atividade recente de descoberta. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero registros no CISA KEV, o que reduz a urgência imediata, mas não elimina o risco: o CVE-2022-24760 concentra o maior score EPSS observado (0,4908), indicando probabilidade não trivial de exploração. O tipo de falha mais recorrente é CWE-863 (Incorrect Authorization), sugerindo que controles de autorização inadequados são um padrão estrutural a ser endereçado em revisões de código e configuração. A presença de 2 CVEs com PoC pública reforça a necessidade de priorizar correções mesmo na ausência de exploração confirmada.

CVE-2026-30835MEDIUMParse Server: Malformed `$regex` query leaks database error details in API responseEPSS 0.3%CVE-2026-31800HIGHParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesEPSS 0.3%CVE-2026-30967HIGHParse Server OAuth2 authentication adapter account takeover via identity spoofingEPSS 0.3%CVE-2026-30228MEDIUMParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionEPSS 0.3%CVE-2025-68150HIGHParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth AdapterEPSS 0.3%CVE-2026-33323MEDIUMParse Server: Email verification resend page leaks user existenceEPSS 0.3%CVE-2026-66008MEDIUMParse Server 9.0.0 Information Disclosure via GraphQL Error MessagesEPSS 0.3%CVE-2026-33429MEDIUMParse Server: Protected field change detection oracle via LiveQuery watch parameterEPSS 0.3%CVE-2026-30848MEDIUMParse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryEPSS 0.3%CVE-2026-34224LOWParse Server: MFA single-use token bypass via concurrent authData login requestsEPSS 0.3%CVE-2026-32742MEDIUMParse Server session creation endpoint allows overwriting server-generated session fieldsEPSS 0.3%CVE-2026-34215HIGHParse Server: Auth data exposed via verify password endpointEPSS 0.3%CVE-2026-30962HIGHParse Server has a protected fields bypass via logical query operatorsEPSS 0.3%CVE-2026-30850MEDIUMParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationEPSS 0.3%CVE-2026-33042MEDIUMParse Server affected by empty authData bypassing credential requirement on signupEPSS 0.3%CVE-2026-47248MEDIUMParse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersEPSS 0.3%CVE-2026-87806CRITICALParse Server 9.0.0 Authentication Bypass via LDAP Empty PasswordEPSS 0.3%CVE-2026-32098MEDIUMParse Server has a protected fields bypass via LiveQuery subscription WHERE clauseEPSS 0.3%CVE-2026-53724LOWParse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistEPSS 0.3%CVE-2026-30854MEDIUMParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledEPSS 0.3%