Vulnerabilidades em parse-community

155 resultados
Análise Vexday

Com 119 CVEs catalogadas e 18 classificadas como críticas, o ecossistema parse-community apresenta uma superfície de ataque relevante, especialmente considerando que 21 vulnerabilidades surgiram nos últimos 90 dias — sinal de atividade recente de descoberta. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero registros no CISA KEV, o que reduz a urgência imediata, mas não elimina o risco: o CVE-2022-24760 concentra o maior score EPSS observado (0,4908), indicando probabilidade não trivial de exploração. O tipo de falha mais recorrente é CWE-863 (Incorrect Authorization), sugerindo que controles de autorização inadequados são um padrão estrutural a ser endereçado em revisões de código e configuração. A presença de 2 CVEs com PoC pública reforça a necessidade de priorizar correções mesmo na ausência de exploração confirmada.

CVE-2026-31856CRITICALParse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLEPSS 0.4%CVE-2026-30966CRITICALParse Server role escalation and CLP bypass via direct `_Join` table writeEPSS 0.4%CVE-2026-31871CRITICALParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLEPSS 0.4%CVE-2026-31840CRITICALParse Server has a SQL injection via dot-notation field name in PostgreSQLEPSS 0.4%CVE-2026-29182HIGHParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionEPSS 0.4%CVE-2026-30229HIGHParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any userEPSS 0.4%CVE-2026-33538HIGHParse Server: Denial of service via unindexed database query for unconfigured auth providersEPSS 0.4%CVE-2025-67727MEDIUMParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege ManagementEPSS 0.4%CVE-2025-62374MEDIUMParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsEPSS 0.4%CVE-2024-47183HIGHParse Server's custom object ID allows to acquire role privilegesEPSS 0.4%CVE-2026-61448LOWParse Server 9.0.0 Stored XSS via malformed Content-TypeEPSS 0.4%CVE-2026-121965MEDIUMParse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation KeyEPSS 0.4%CVE-2026-33421HIGHParse Server: LiveQuery bypasses CLP pointer permission enforcementEPSS 0.4%CVE-2025-30168MEDIUMParse Server has an OAuth login vulnerabilityEPSS 0.4%CVE-2026-112768MEDIUMParse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User UpdateEPSS 0.4%CVE-2026-30972MEDIUMParse Server has a rate limit bypass via batch request endpointEPSS 0.4%CVE-2026-34784HIGHParse Server: Streaming file download bypasses afterFind file trigger authorizationEPSS 0.4%CVE-2026-33627HIGHParse Server: Auth data exposed via /users/me endpointEPSS 0.4%CVE-2026-30967HIGHParse Server OAuth2 authentication adapter account takeover via identity spoofingEPSS 0.4%CVE-2026-27610HIGHParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsEPSS 0.4%