Parse-server
128 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Parse-server, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Parse-server CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 2 |
| 2025-12 | 3 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 65 |
| 2026-04 | 3 |
| 2026-05 | 1 |
| 2026-06 | 10 |
| 2026-07 | 7 |
| 2026-08 | 0 |
| 2026-09 | 3 |
Severity
How the 128 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical18
- High48
- Medium40
- Low5
Latest CVEs
The 15 most recently published vulnerabilities affecting Parse-server.
- CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection7.5
- CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery6.5
- CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password7.4
- CVE-2026-66009Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages—
- CVE-2026-66008Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages—
- CVE-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion—
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Type—
- CVE-2026-57481Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change—
- CVE-2026-57480Parse Server: Denial of service via exponential-time processing of deeply nested query operators—
- CVE-2026-55778Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist—
- CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tags7.5
- CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tags7.5
- GHSA-97pr-9hgg-3p8rparse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change—
- GHSA-cgxm-vr2f-6fj8parse-server: Denial of service via exponential-time processing of deeply nested query operators—
- CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL—
Product grouping is registry-driven, with AI assist and human review. How it works