Parse-Community · weakness class
Information Disclosure
29 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 1
Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.
- Parse Server - GraphQL Schema Information Disclosure
- Protected fields exposed via LiveQuery in parse-server
- Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
- LiveQuery publishes user session tokens
- Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
- Parse Server leaks protected fields via LiveQuery afterEvent trigger
- Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
- Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details
- Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- Parse Server: Auth data exposed via /users/me endpoint
- Parse Server: Malformed `$regex` query leaks database error details in API response
- Parse Server: Email verification resend page leaks user existence
- Parse Server: Protected field change detection oracle via LiveQuery watch parameter
- Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause
- Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors
- Parse Server: Auth data exposed via verify password endpoint
- Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery
- Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers
- Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
- Parse Server has user enumeration via email verification endpoint
- Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
- Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update
- Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses
- Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
- Parse Server has a login timing side-channel reveals user existence
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.