Parse-server
This hub aggregates every CVE we track for Parse-server, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
128
CVEs tracked
18
Critical
48
High
0
In CISA KEV
Severity distribution
HIGH48MEDIUM40CRITICAL18LOW5
Monthly trend
1
0
0
0
0
1
0
0
0
1
0
0
0
2
3
0
1
65
3
1
10
7
0
3
2024-102026-09
Latest CVEs
The 15 most recently published vulnerabilities affecting Parse-server.
- CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection7.5
- CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery6.5
- CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password7.4
- CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Type
- CVE-2026-57481Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
- CVE-2026-57480Parse Server: Denial of service via exponential-time processing of deeply nested query operators
- CVE-2026-55778Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
- CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tags7.5
- CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tags7.5
- GHSA-97pr-9hgg-3p8rparse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
- GHSA-cgxm-vr2f-6fj8parse-server: Denial of service via exponential-time processing of deeply nested query operators
- CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Product normalization is registry-driven with AI assist and human review. How it works