CVE Tools
Track your stack

Parse-server

137 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Parse-server, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Parse-server CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Parse-server CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-031
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-100
2025-112
2025-123
2026-010
2026-021
2026-0365
2026-043
2026-051
2026-0610
2026-077
2026-080
2026-094
2026-108

Severity

How the 137 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1816%
  • High4841%
  • Medium4438%
  • Low65%

Latest CVEs

The 15 most recently published vulnerabilities affecting Parse-server.

  1. CVE-2026-112769Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass—
  2. CVE-2026-112768Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update—
  3. CVE-2026-110854Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error—
  4. CVE-2026-109954Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference6.5
  5. CVE-2026-109303Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query4.3
  6. CVE-2026-109302Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries3.7
  7. CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL5.9
  8. CVE-2026-105828Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors—
  9. CVE-2026-101042Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity6.4
  10. CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery6.5
  11. CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection7.5
  12. CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password7.4
  13. CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages—
  14. CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages—
  15. CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion—

Product grouping is registry-driven, with AI assist and human review. How it works