Parse-Community · product
parse-server
152 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 2
- likely to be exploited
- 3
Every one of the 152 is a mark on the map. Named now: 1 to 26, most at risk first.
- Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration
- Parse Server - GraphQL Schema Information Disclosure
- Command Injection in Parse server
- Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
- ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
- Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
- Crash server with query parameter
- Protected fields exposed via LiveQuery in parse-server
- Parse Server may crash when uploading file without extension
- Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
- LiveQuery publishes user session tokens
- Parse Server crash and RCE via invalid Cloud Function or Cloud Job name
- Improper session expiration in Parse Server
- Invalid file request can crashe parse-server
- Information disclosure through Viewer query in parse-server
- Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
- Parse Server literalizeRegexPart SQL Injection
- New anonymous user session acts as if it's created with password
- Parse Server subject to Prototype pollution via Cloud Code Webhooks
- Authentication bypass in Parse Server Apple Game Center auth adapter
- Information disclosure in parse-server
- Parse Server crashes when receiving file download request with invalid byte range
- Parse Server stores password in plain text
- Trigger `beforeFind` not invoked in internal query pipeline in parse-server
- Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
- Parse Server: Account takeover via operator injection in authentication data identifier
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP