Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

parse-server — Vulnerabilities & Security Advisories 122

All 122 CVE vulnerabilities found in parse-server, with AI-generated Chinese analysis, references, and POCs.

This page documents vulnerability aggregations for the open-source Node.js backend framework known as parse-server, specifically focusing on security weaknesses and related advisories. It collects information regarding various vulnerability types, including injection flaws, broken access control, and security misconfigurations, covering reports published from early 2018 through the present day. The scope includes both critical severity issues and lower-severity defects that impact the stability and confidentiality of applications built on this platform. Here, users can track advisories issued by the maintainers and community contributors to understand the timeline of security patches and hotfixes released for the project. Readers can analyze trends in weakness classes to identify recurring patterns in the codebase that may indicate systemic architectural issues. Additionally, the page provides a comprehensive history of vulnerabilities associated with parse-server, allowing developers to review past incidents and assess the impact of specific versions. This resource serves as a central reference for security auditors and developers seeking to understand the risk landscape of the product. By aggregating data from multiple sources, including GitHub issues, package managers, and security databases, the page offers a holistic view of the product's security posture over time, facilitating better risk management and informed decision-making for users integrating parse-server into their technology stacks.

Vendor: Parse

CVE IDTitleCVSSSeverityPublished
CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages CWE-209 6.3 Medium2026-07-24
CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages CWE-209 6.3 Medium2026-07-24
CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion CWE-209--2026-07-21
CVE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type CWE-434--2026-07-11
CVE-2026-57481 Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change CWE-200--2026-07-08
CVE-2026-57480 Parse Server: Denial of service via exponential-time processing of deeply nested query operators CWE-407--2026-07-08
CVE-2026-55778 Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist CWE-434--2026-07-08
CVE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags CWE-494 7.5 High2026-06-25
CVE-2021-47986 Parse Server - Unreviewed Code Execution via Malicious Version Tags CWE-494 7.5 High2026-06-25
CVE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL CWE-639--2026-06-12
CVE-2026-53725 Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied CWE-200--2026-06-12
CVE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist CWE-434--2026-06-12
CVE-2026-50008 Parse Server: Server option routeAllowList is bypassable through batch sub-requests CWE-863--2026-06-12
CVE-2026-47138 Parse Server: Pre-authentication denial of service via client version header regex backtracking CWE-1333--2026-06-12
CVE-2026-47248 Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers CWE-209--2026-06-12
CVE-2026-43930 Parse Server: MFA SMS one-time password accepted twice under concurrent login CWE-362--2026-05-12
CVE-2026-39381 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` CWE-863 6.5AIMediumAI2026-04-07
CVE-2026-39321 Parse Server has a login timing side-channel reveals user existence CWE-208 4.8AIMediumAI2026-04-07
CVE-2026-35200 Parse Server has a file upload Content-Type override via extension mismatch CWE-436 8.2AIHighAI2026-04-06
CVE-2026-34784 Parse Server: Streaming file download bypasses afterFind file trigger authorization CWE-285 7.5 -2026-03-31
CVE-2026-34215 Parse Server: Auth data exposed via verify password endpoint CWE-200 6.5 -2026-03-31
CVE-2026-34595 Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value CWE-843 8.8AIHighAI2026-03-31
CVE-2026-34574 Parse Server: Session field immutability bypass via falsy-value guard CWE-697 7.1AIHighAI2026-03-31
CVE-2026-34573 Parse Server: GraphQL complexity validator exponential fragment traversal DoS CWE-407 7.5AIHighAI2026-03-31
CVE-2026-34532 Parse Server: Cloud function validator bypass via prototype chain traversal CWE-863 9.1AICriticalAI2026-03-31
CVE-2026-34373 Parse Server: GraphQL API endpoint ignores CORS origin restriction CWE-346 8.2AIHighAI2026-03-31
CVE-2026-34363 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers CWE-362 7.5AIHighAI2026-03-31
CVE-2026-34224 Parse Server: MFA single-use token bypass via concurrent authData login requests CWE-367 8.2AIHighAI2026-03-31
CVE-2026-33627 Parse Server: Auth data exposed via /users/me endpoint CWE-200 8.1 -2026-03-24
CVE-2026-33624 Parse Server: MFA recovery code single-use bypass via concurrent requests CWE-367 9.1 -2026-03-24

All 122 known CVE vulnerabilities affecting parse-server with full Chinese analysis, references, and POCs where available.