CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 4,028 CVEs published, 328 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
4,028
Show in the list
Critical, last 7 days
328
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,756
Show in the list

Showing CVEs that name the product parseplatform:parse-server. Show all products

74 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2025-67727Medium 6.9Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
Assigned by GitHub_M
Dec 12, 2025
CVE-2025-68115Medium 5.3Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables
Assigned by GitHub_M
Dec 15, 2025
CVE-2025-68150High 8.3Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter
Assigned by GitHub_M
Dec 16, 2025
CVE-2026-27804Critical 9.3Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
Assigned by GitHub_M
Feb 25, 2026
CVE-2026-29182High 8.6Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
Assigned by GitHub_M
Mar 6, 2026
CVE-2026-30228Medium 6.9Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction
Assigned by GitHub_M
Mar 6, 2026
CVE-2026-30229High 8.5Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Assigned by GitHub_M
Mar 6, 2026
CVE-2026-30835Medium 6.9Parse Server: Malformed `$regex` query leaks database error details in API response
Assigned by GitHub_M
Mar 6, 2026
CVE-2026-30863Critical 9.3Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Assigned by GitHub_M
Mar 7, 2026
CVE-2026-30848Medium 6.3Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
Assigned by GitHub_M
Mar 7, 2026
CVE-2026-30850Medium 6.3Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
Assigned by GitHub_M
Mar 7, 2026
CVE-2026-30854Medium 6.9Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Assigned by GitHub_M
Mar 7, 2026
CVE-2026-30925High 8.2Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Assigned by GitHub_M
Mar 9, 2026
CVE-2026-30938Medium 6.9Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30939High 8.8Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30941High 8.7Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30946High 8.7Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30947High 8.7Parse Server ha a bypass of class-level permissions in LiveQuery
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30948High 8.3Parse Server has stored cross-site scripting (XSS) via SVG file upload
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30949High 7.6Parse Server is missing audience validation in Keycloak authentication adapter
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30962High 7.1Parse Server has a protected fields bypass via logical query operators
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30965Critical 9.9Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30966Critical 10.0Parse Server role escalation and CLP bypass via direct `_Join` table write
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30967High 7.6Parse Server OAuth2 authentication adapter account takeover via identity spoofing
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30972Medium 6.9Parse Server has a rate limit bypass via batch request endpoint
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-31800High 8.8Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-31828Medium 6.0Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-31840Critical 9.3Parse Server has a SQL injection via dot-notation field name in PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31856Critical 9.3Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31868Medium 6.3Parse Server has Stored XSS via file upload of HTML-renderable file types
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31871Critical 9.3Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31872High 8.7Parse Server has a protected fields bypass via dot-notation in query and sort
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31875High 8.2Parse Server MFA recovery codes not consumed after use
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31901Medium 6.3Parse Server has user enumeration via email verification endpoint
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-32098Medium 6.9Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-32234Medium 5.1Parse Server has a SQL injection via query field name when using PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-32242Critical 9.1Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
Assigned by GitHub_M
Mar 12, 2026
CVE-2026-32248Critical 9.3Parse Server: Account takeover via operator injection in authentication data identifier
Assigned by GitHub_M
Mar 12, 2026
CVE-2026-32269Medium 6.3Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
Assigned by GitHub_M
Mar 12, 2026
CVE-2026-32594Medium 6.9Parse Server GraphQL WebSocket endpoint bypasses security middleware
Assigned by GitHub_M
Mar 13, 2026
CVE-2026-32728High 8.3Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32742Medium 4.3Parse Server session creation endpoint allows overwriting server-generated session fields
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32770Medium 5.9Parse Server: LiveQuery subscription with invalid regular expression crashes server
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32878Medium 5.3Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32886High 8.2Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32943Low 2.3Parse Server has a password reset token single-use bypass via concurrent requests
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32944High 8.7Parse Server crash via deeply nested query condition operators
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-33042Medium 6.9Parse Server affected by empty authData bypassing credential requirement on signup
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-33163High 8.2Parse Server leaks protected fields via LiveQuery afterEvent trigger
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-33323Medium 6.3Parse Server: Email verification resend page leaks user existence
Assigned by GitHub_M
Mar 24, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.