parse-community vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116165 Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the High 8.8 · Oct 25, 2026
• CVE-2026-116163 Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methoCritical 9.1 · Oct 25, 2026
• CVE-2026-110854 Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the serverHigh 8.2 · Oct 14, 2026
• CVE-2026-109954 Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactionalHigh 8.3 · Oct 13, 2026
• CVE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveHigh 8.2 · Oct 12, 2026
• CVE-2026-101042 Parse Server is an open-source backend server.High 7.4 · Sep 27, 2026
• CVE-2026-100632 Parse Server is an open-source backend server.High 7.1 · Sep 26, 2026
• CVE-2026-100631 Parse Server is an open source backend server.High 8.7 · Sep 26, 2026
• CVE-2026-87806 Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter.Critical 9.1 · Sep 9, 2026
• CVE-2026-57480 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.7 · Jul 8, 2026
• CVE-2021-47987 Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unrevieHigh 7.7 · Jun 25, 2026
• CVE-2021-47986 Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a persHigh 7.7 · Jun 25, 2026
• CVE-2026-47138 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.7 · Jun 12, 2026
• CVE-2026-34784 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.2 · Mar 31, 2026
• CVE-2026-34215 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.2 · Mar 31, 2026
• CVE-2026-34573 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.2 · Mar 31, 2026
• CVE-2026-34532 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Critical 9.1 · Mar 31, 2026
• CVE-2026-34363 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.2 · Mar 31, 2026
• CVE-2026-33627 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 7.1 · Mar 24, 2026
• CVE-2026-33539 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.6 · Mar 24, 2026
• CVE-2026-33538 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.7 · Mar 24, 2026
• CVE-2026-33508 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.2 · Mar 24, 2026
• CVE-2026-33498 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 8.7 · Mar 24, 2026
• CVE-2026-33421 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 7.1 · Mar 24, 2026
• CVE-2026-33409 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.High 7 · Mar 24, 2026