Vulnerabilities in parse-community
156 resultsCVE-2026-53724LOWParse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistEPSS 0.3%CVE-2026-31901MEDIUMParse Server has user enumeration via email verification endpointEPSS 0.3%CVE-2026-53726MEDIUMParse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLEPSS 0.3%CVE-2026-32242CRITICALParse Server OAuth2 adapter shares mutable state across providers via singleton instanceEPSS 0.3%CVE-2026-33527MEDIUMParse Server: Session update endpoint allows overwriting server-generated session fieldsEPSS 0.3%CVE-2026-119126LOWParse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation KeysEPSS 0.3%CVE-2026-110854HIGHParse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email ErrorEPSS 0.3%CVE-2026-34595MEDIUMParse Server: LiveQuery protected-field guard bypass via array-like logical operator valueEPSS 0.3%CVE-2026-27608CRITICALParse Dashboard Missing Authorization on Agent EndpointEPSS 0.3%CVE-2026-116801MEDIUMParse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo QueryEPSS 0.3%CVE-2026-119570LOWParse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save ResponsesEPSS 0.3%CVE-2026-53725MEDIUMParse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is deniedEPSS 0.3%CVE-2026-119125LOWParse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted FieldsEPSS 0.3%CVE-2026-30948HIGHParse Server has stored cross-site scripting (XSS) via SVG file uploadEPSS 0.2%CVE-2026-39321MEDIUMParse Server has a login timing side-channel reveals user existenceEPSS 0.2%CVE-2026-43930LOWParse Server: MFA SMS one-time password accepted twice under concurrent loginEPSS 0.2%CVE-2026-32234MEDIUMParse Server has a SQL injection via query field name when using PostgreSQLEPSS 0.2%CVE-2026-109302MEDIUMParse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted QueriesEPSS 0.2%CVE-2026-32943LOWParse Server has a password reset token single-use bypass via concurrent requestsEPSS 0.2%CVE-2026-119571MEDIUMParse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation IDEPSS 0.2%