Product by Parse-community
Parse-server
149 known vulnerabilities in Parse-server (Parse-community), 0 of them actively exploited (CISA KEV).
Key figures
149
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
23
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-39309 | ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability | 9.8 | |
| Critical | CVE-2022-24760 | Command Injection in Parse server | 10.0 | |
| Critical | CVE-2022-39396 | Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser | 9.8 | |
| Critical | CVE-2023-36475 | Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution | 9.8 | |
| Critical | CVE-2026-30965 | Parse Server session token exfiltration via `redirectClassNameForKey` query parameter | 9.1 | |
| High | CVE-2021-39187 | Crash server with query parameter | 7.5 | |
| Critical | CVE-2024-29027 | Parse Server crash and RCE via invalid Cloud Function or Cloud Job name | 9.1 | |
| Critical | CVE-2024-27298 | Parse Server literalizeRegexPart SQL Injection | 10.0 | |
| Critical | CVE-2026-87806 | Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password | 7.4 | |
| Critical | CVE-2026-32248 | Parse Server: Account takeover via operator injection in authentication data identifier | 9.8 | |
| High | CVE-2022-36079 | Parse Server vulnerable to brute force guessing of user sensitive data via search patterns | 8.6 | |
| High | CVE-2022-31112 | Protected fields exposed via LiveQuery in parse-server | 8.2 | |
| Critical | CVE-2026-30863 | Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters | 9.8 | |
| High | CVE-2026-57480 | Parse Server: Denial of service via exponential-time processing of deeply nested query operators | — | |
| High | CVE-2023-46119 | Parse Server may crash when uploading file without extension | 7.5 | |
| High | CVE-2026-47138 | Parse Server: Pre-authentication denial of service via client version header regex backtracking | — | |
| Critical | CVE-2026-116163 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses | 7.4 | |
| High | CVE-2026-116165 | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB | — | |
| High | CVE-2026-100631 | Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection | 7.5 | |
| High | CVE-2026-109301 | Parse-community Parse-server: Uncaught Exception | 5.9 | |
| High | CVE-2026-34573 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS | 7.5 | |
| High | CVE-2026-30946 | Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API | 7.5 | |
| High | CVE-2021-41109 | LiveQuery publishes user session tokens | 7.5 | |
| Critical | CVE-2026-31856 | Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL | 9.8 | |
| Critical | CVE-2026-31871 | Parse-community Parse-server: SQL Injection | 9.8 |