CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 4,043 CVEs published, 329 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
4,043
Show in the list
Critical, last 7 days
329
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,756
Show in the list

Showing CVEs that name the product parseplatform:parse-server. Show all products

74 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2021-47986High 7.5Parse Server - Unreviewed Code Execution via Malicious Version Tags
Assigned by VulnCheck
Jun 25, 2026
CVE-2026-43930Low 2.1Parse Server: MFA SMS one-time password accepted twice under concurrent login
Assigned by GitHub_M
May 12, 2026
CVE-2026-39381Medium 5.3Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Assigned by GitHub_M
Apr 7, 2026
CVE-2026-39321Medium 6.3Parse Server has a login timing side-channel reveals user existence
Assigned by GitHub_M
Apr 7, 2026
CVE-2026-35200Low 2.1Parse Server has a file upload Content-Type override via extension mismatch
Assigned by GitHub_M
Apr 6, 2026
CVE-2026-34784High 8.2Parse Server: Streaming file download bypasses afterFind file trigger authorization
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34215High 8.2Parse Server: Auth data exposed via verify password endpoint
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34595Medium 5.3Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34574Medium 5.3Parse Server: Session field immutability bypass via falsy-value guard
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34573High 8.2Parse Server: GraphQL complexity validator exponential fragment traversal DoS
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34532Critical 9.1Parse Server: Cloud function validator bypass via prototype chain traversal
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34373Medium 5.3Parse Server: GraphQL API endpoint ignores CORS origin restriction
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34363High 8.2Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-34224Low 2.1Parse Server: MFA single-use token bypass via concurrent authData login requests
Assigned by GitHub_M
Mar 31, 2026
CVE-2026-33627High 7.1Parse Server: Auth data exposed via /users/me endpoint
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33624Low 2.1Parse Server: MFA recovery code single-use bypass via concurrent requests
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33539High 8.6Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33538High 8.7Parse Server: Denial of service via unindexed database query for unconfigured auth providers
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33527Medium 5.3Parse Server: Session update endpoint allows overwriting server-generated session fields
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33508High 8.2Parse Server: LiveQuery subscription query depth bypass
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33498High 8.7Parse Server: Query condition depth bypass via pre-validation transform pipeline
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33429Medium 6.3Parse Server: Protected field change detection oracle via LiveQuery watch parameter
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33421High 7.1Parse Server: LiveQuery bypasses CLP pointer permission enforcement
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33409High 7.0Parse Server: Auth provider validation bypass on login via partial authData
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33323Medium 6.3Parse Server: Email verification resend page leaks user existence
Assigned by GitHub_M
Mar 24, 2026
CVE-2026-33163High 8.2Parse Server leaks protected fields via LiveQuery afterEvent trigger
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-33042Medium 6.9Parse Server affected by empty authData bypassing credential requirement on signup
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32944High 8.7Parse Server crash via deeply nested query condition operators
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32943Low 2.3Parse Server has a password reset token single-use bypass via concurrent requests
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32886High 8.2Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32878Medium 5.3Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32770Medium 5.9Parse Server: LiveQuery subscription with invalid regular expression crashes server
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32742Medium 4.3Parse Server session creation endpoint allows overwriting server-generated session fields
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32728High 8.3Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Assigned by GitHub_M
Mar 18, 2026
CVE-2026-32594Medium 6.9Parse Server GraphQL WebSocket endpoint bypasses security middleware
Assigned by GitHub_M
Mar 13, 2026
CVE-2026-32269Medium 6.3Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
Assigned by GitHub_M
Mar 12, 2026
CVE-2026-32248Critical 9.3Parse Server: Account takeover via operator injection in authentication data identifier
Assigned by GitHub_M
Mar 12, 2026
CVE-2026-32242Critical 9.1Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
Assigned by GitHub_M
Mar 12, 2026
CVE-2026-32234Medium 5.1Parse Server has a SQL injection via query field name when using PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-32098Medium 6.9Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31901Medium 6.3Parse Server has user enumeration via email verification endpoint
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31875High 8.2Parse Server MFA recovery codes not consumed after use
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31872High 8.7Parse Server has a protected fields bypass via dot-notation in query and sort
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31871Critical 9.3Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31868Medium 6.3Parse Server has Stored XSS via file upload of HTML-renderable file types
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31856Critical 9.3Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31840Critical 9.3Parse Server has a SQL injection via dot-notation field name in PostgreSQL
Assigned by GitHub_M
Mar 11, 2026
CVE-2026-31828Medium 6.0Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-31800High 8.8Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
Assigned by GitHub_M
Mar 10, 2026
CVE-2026-30972Medium 6.9Parse Server has a rate limit bypass via batch request endpoint
Assigned by GitHub_M
Mar 10, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.