parse-community

Top products

The 15 most recently published vulnerabilities affecting parse-community.

• CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection7.5Sep 26, 2026
• CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery6.5Sep 26, 2026
• CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password7.4Sep 9, 2026
• CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error MessagesJul 24, 2026
• CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error MessagesJul 24, 2026
• CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable CoercionJul 21, 2026
• CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-TypeJul 11, 2026
• CVE-2026-57481Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access changeJul 8, 2026
• CVE-2026-57480Parse Server: Denial of service via exponential-time processing of deeply nested query operatorsJul 8, 2026
• CVE-2026-55778Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklistJul 8, 2026
• CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tags7.5Jun 25, 2026
• CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tags7.5Jun 25, 2026
• CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLJun 12, 2026
• CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is deniedJun 12, 2026
• CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistJun 12, 2026