Vulnerabilities in parse-community
156 resultsCVE-2026-32098MEDIUMParse Server has a protected fields bypass via LiveQuery subscription WHERE clauseEPSS 0.3%CVE-2026-105828MEDIUMParse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL ErrorsEPSS 0.3%CVE-2026-30850MEDIUMParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationEPSS 0.3%CVE-2025-68150HIGHParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth AdapterEPSS 0.3%CVE-2026-112769LOWParse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission BypassEPSS 0.3%CVE-2026-32742MEDIUMParse Server session creation endpoint allows overwriting server-generated session fieldsEPSS 0.3%CVE-2026-116165HIGHParse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDBEPSS 0.3%CVE-2026-34224LOWParse Server: MFA single-use token bypass via concurrent authData login requestsEPSS 0.3%CVE-2026-34215HIGHParse Server: Auth data exposed via verify password endpointEPSS 0.3%CVE-2026-33042MEDIUMParse Server affected by empty authData bypassing credential requirement on signupEPSS 0.3%CVE-2026-121413LOWParse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSessionEPSS 0.3%CVE-2026-30854MEDIUMParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledEPSS 0.3%CVE-2026-100632HIGHParse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQueryEPSS 0.3%CVE-2026-32269MEDIUMParse Server OAuth2 adapter app ID validation sends wrong token to introspection endpointEPSS 0.3%CVE-2026-47248MEDIUMParse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersEPSS 0.3%CVE-2026-116161MEDIUMParse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or SubscriptionsEPSS 0.3%CVE-2026-32728HIGHParse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesEPSS 0.3%CVE-2026-31868MEDIUMParse Server has Stored XSS via file upload of HTML-renderable file typesEPSS 0.3%CVE-2026-34532CRITICALParse Server: Cloud function validator bypass via prototype chain traversalEPSS 0.3%CVE-2026-116163CRITICALParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter SubclassesEPSS 0.3%