Latest vulnerabilities for "npm/parse-server"

npm/parse-serverParse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Risk 33

Severity

6.9

First published (updated )

CVE-2026-53726

npm/parse-serverParse Server: Server option routeAllowList is bypassable through batch sub-requests

Risk 41

Severity

6.9

First published (updated )

CVE-2026-50008

🚨 14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-26): Critical Worms, Parse Server DoS, and AI RCEs

First published (updated )

Social

npm/parse-serverParse Server: Streaming file download bypasses afterFind file trigger authorization

Risk 43

Severity

8.2

First published (updated )

CVE-2026-34784

parseplatform Parse-server Node.jsParse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Risk 26

Severity

5.3

First published (updated )

CVE-2026-34595

parseplatform Parse-server Node.jsParse Server: GraphQL complexity validator exponential fragment traversal DoS

Risk 43

Severity

8.2

First published (updated )

CVE-2026-34573

parseplatform Parse-server Node.jsParse Server: Cloud function validator bypass via prototype chain traversal

Risk 63

Severity

9.1

First published (updated )

CVE-2026-34532

parseplatform Parse-server Node.jsParse Server: Auth data exposed via /users/me endpoint

Risk 29

Severity

7.1

EPSS

0.06%

First published (updated )

CVE-2026-33627

parseplatform Parse-server Node.jsParse Server: MFA recovery code single-use bypass via concurrent requests

Risk 12

Severity

2.1

EPSS

0.03%

First published (updated )

CVE-2026-33624

parseplatform Parse-server Node.jsParse Server has a password reset token single-use bypass via concurrent requests

Risk 13

Severity

2.3

EPSS

0.03%

First published (updated )

CVE-2026-32943

parseplatform Parse-server Node.jsParse Server GraphQL WebSocket endpoint bypasses security middleware

Risk 36

Severity

6.9

EPSS

0.08%

First published (updated )

CVE-2026-32594

parseplatform Parse-server Node.jsParse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Risk 28

Severity

6.5

EPSS

0.05%

First published (updated )

CVE-2026-32269

parseplatform Parse-server Node.jsParse Server has a SQL injection via query field name when using PostgreSQL

Risk 28

Severity

5.1

EPSS

0.04%

First published (updated )

CVE-2026-32234

parseplatform Parse-server Node.jsParse Server has a protected fields bypass via LiveQuery subscription WHERE clause

Risk 31

Severity

6.9

EPSS

0.04%

First published (updated )

CVE-2026-32098

parseplatform Parse-server Node.jsParse Server has an LDAP injection via unsanitized user input in DN and group filter construction

Risk 56

Severity

6

EPSS

0.09%

First published (updated )

CVE-2026-31828

parseplatform Parse-server Node.jsParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Risk 47

Severity

8.8

EPSS

0.09%

First published (updated )

CVE-2026-31800

parseplatform Parse-server Node.jsParse Server has a rate limit bypass via batch request endpoint

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-30972

parseplatform Parse-server Node.jsParse Server role escalation and CLP bypass via direct `_Join` table write

Risk 58

Severity

10

EPSS

0.06%

First published (updated )

CVE-2026-30966

parseplatform Parse-server Node.jsParse Server session token exfiltration via `redirectClassNameForKey` query parameter

Risk 49

Severity

9.9

EPSS

0.06%

First published (updated )

CVE-2026-30965

parseplatform Parse-server Node.jsParse Server has a protected fields bypass via logical query operators

Risk 29

Severity

7.1

EPSS

0.03%

First published (updated )

CVE-2026-30962

parseplatform Parse-server Node.jsParse Server is missing audience validation in Keycloak authentication adapter

Risk 41

Severity

8.8

EPSS

0.03%

First published (updated )

CVE-2026-30949

parseplatform Parse-server Node.jsParse Server has stored cross-site scripting (XSS) via SVG file upload

Risk 45

Severity

8.3

EPSS

0.02%

First published (updated )

CVE-2026-30948

npm/parse-serverParse Server ha a bypass of class-level permissions in LiveQuery

Risk 33

Severity

8.7

EPSS

0.02%

First published (updated )

CVE-2026-30947

npm/parse-serverParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Risk 33

Severity

8.7

EPSS

0.02%

First published (updated )

CVE-2026-30946

npm/parse-serverParse Server has a NoSQL injection via token type in password reset and email verification endpoints

Risk 33

Severity

8.7

EPSS

0.05%

First published (updated )

CVE-2026-30941

parseplatform Parse-server Node.jsParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Risk 31

Severity

8.2

EPSS

0.02%

First published (updated )

CVE-2026-30925

parseplatform Parse-server Node.jsParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Risk 23

Severity

6.9

EPSS

0.06%

First published (updated )

CVE-2026-30854

parseplatform Parse-server Node.jsParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Risk 21

Severity

6.3

EPSS

0.05%

First published (updated )

CVE-2026-30850

parseplatform Parse-server Node.jsParse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

Risk 21

Severity

6.3

EPSS

0.07%

First published (updated )

CVE-2026-30848

parseplatform Parse-server Node.jsParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Risk 61

Severity

9.8

EPSS

0.08%

First published (updated )

CVE-2026-30863

Trending

npm/parse-serverParse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

npm/parse-serverParse Server: Server option routeAllowList is bypassable through batch sub-requests

🚨 14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-26): Critical Worms, Parse Server DoS, and AI RCEs

npm/parse-serverParse Server: Streaming file download bypasses afterFind file trigger authorization

parseplatform Parse-server Node.jsParse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Don't miss critical vulnerabilities

parseplatform Parse-server Node.jsParse Server: GraphQL complexity validator exponential fragment traversal DoS

parseplatform Parse-server Node.jsParse Server: Cloud function validator bypass via prototype chain traversal

parseplatform Parse-server Node.jsParse Server: Auth data exposed via /users/me endpoint

parseplatform Parse-server Node.jsParse Server: MFA recovery code single-use bypass via concurrent requests

parseplatform Parse-server Node.jsParse Server has a password reset token single-use bypass via concurrent requests

Don't miss critical vulnerabilities

parseplatform Parse-server Node.jsParse Server GraphQL WebSocket endpoint bypasses security middleware

parseplatform Parse-server Node.jsParse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

parseplatform Parse-server Node.jsParse Server has a SQL injection via query field name when using PostgreSQL

parseplatform Parse-server Node.jsParse Server has a protected fields bypass via LiveQuery subscription WHERE clause

parseplatform Parse-server Node.jsParse Server has an LDAP injection via unsanitized user input in DN and group filter construction

Don't miss critical vulnerabilities

parseplatform Parse-server Node.jsParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

parseplatform Parse-server Node.jsParse Server has a rate limit bypass via batch request endpoint

parseplatform Parse-server Node.jsParse Server role escalation and CLP bypass via direct `_Join` table write

parseplatform Parse-server Node.jsParse Server session token exfiltration via `redirectClassNameForKey` query parameter

parseplatform Parse-server Node.jsParse Server has a protected fields bypass via logical query operators

Don't miss critical vulnerabilities

parseplatform Parse-server Node.jsParse Server is missing audience validation in Keycloak authentication adapter

parseplatform Parse-server Node.jsParse Server has stored cross-site scripting (XSS) via SVG file upload

npm/parse-serverParse Server ha a bypass of class-level permissions in LiveQuery

npm/parse-serverParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

npm/parse-serverParse Server has a NoSQL injection via token type in password reset and email verification endpoints

Don't miss critical vulnerabilities

parseplatform Parse-server Node.jsParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

parseplatform Parse-server Node.jsParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

parseplatform Parse-server Node.jsParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

parseplatform Parse-server Node.jsParse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

parseplatform Parse-server Node.jsParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Don't miss critical vulnerabilities

Company

Resources

Contact