Vulnerabilidades em parse-community

156 resultados
Análise Vexday

Com 119 CVEs catalogadas e 18 classificadas como críticas, o ecossistema parse-community apresenta uma superfície de ataque relevante, especialmente considerando que 21 vulnerabilidades surgiram nos últimos 90 dias — sinal de atividade recente de descoberta. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero registros no CISA KEV, o que reduz a urgência imediata, mas não elimina o risco: o CVE-2022-24760 concentra o maior score EPSS observado (0,4908), indicando probabilidade não trivial de exploração. O tipo de falha mais recorrente é CWE-863 (Incorrect Authorization), sugerindo que controles de autorização inadequados são um padrão estrutural a ser endereçado em revisões de código e configuração. A presença de 2 CVEs com PoC pública reforça a necessidade de priorizar correções mesmo na ausência de exploração confirmada.

CVE-2026-27610HIGHParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsEPSS 0.4%CVE-2026-116162LOWParse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA LoginEPSS 0.4%CVE-2026-31800HIGHParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesEPSS 0.4%CVE-2026-119569MEDIUMParse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of ServiceEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2026-30835MEDIUMParse Server: Malformed `$regex` query leaks database error details in API responseEPSS 0.4%CVE-2026-121415MEDIUMParse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation KeyEPSS 0.4%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.4%CVE-2026-32594MEDIUMParse Server GraphQL WebSocket endpoint bypasses security middlewareEPSS 0.4%CVE-2026-30228MEDIUMParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionEPSS 0.4%CVE-2026-100631HIGHParse Server 9.0.0 Unauthenticated Installation Deletion via Operator InjectionEPSS 0.4%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.4%CVE-2026-109301HIGHParse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URLEPSS 0.3%CVE-2026-30848MEDIUMParse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryEPSS 0.3%CVE-2026-30962HIGHParse Server has a protected fields bypass via logical query operatorsEPSS 0.3%CVE-2026-116164MEDIUMParse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object WritesEPSS 0.3%CVE-2026-50008MEDIUMParse Server: Server option routeAllowList is bypassable through batch sub-requestsEPSS 0.3%CVE-2026-33323MEDIUMParse Server: Email verification resend page leaks user existenceEPSS 0.3%CVE-2026-121414HIGHParse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer UpdateEPSS 0.3%CVE-2026-33429MEDIUMParse Server: Protected field change detection oracle via LiveQuery watch parameterEPSS 0.3%