Product by Parseplatform
Parse Platform parse-server
103 known vulnerabilities in Parse Platform parse-server (Parseplatform), 0 of them actively exploited (CISA KEV).
Key figures
103
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
20
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-24760 | Command Injection in Parse server | 10.0 | |
| Critical | CVE-2022-39396 | Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser | 9.8 | |
| Critical | CVE-2023-36475 | Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution | 9.8 | |
| Critical | CVE-2026-30965 | Parse Server session token exfiltration via `redirectClassNameForKey` query parameter | 9.1 | |
| High | CVE-2021-39187 | Crash server with query parameter | 7.5 | |
| Critical | CVE-2024-29027 | Parse Server crash and RCE via invalid Cloud Function or Cloud Job name | 9.1 | |
| Critical | CVE-2024-27298 | Parse Server literalizeRegexPart SQL Injection | 10.0 | |
| Critical | CVE-2026-32248 | Parse Server: Account takeover via operator injection in authentication data identifier | 9.8 | |
| High | CVE-2022-36079 | Parse Server vulnerable to brute force guessing of user sensitive data via search patterns | 8.6 | |
| High | CVE-2022-31112 | Protected fields exposed via LiveQuery in parse-server | 8.2 | |
| Critical | CVE-2026-30863 | Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters | 9.8 | |
| High | CVE-2023-46119 | Parse Server may crash when uploading file without extension | 7.5 | |
| High | CVE-2019-1020012 | Parse-server: security vulnerability | 7.5 | |
| High | CVE-2026-34573 | Parse Server: GraphQL complexity validator exponential fragment traversal DoS | 7.5 | |
| High | CVE-2026-30946 | Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API | 7.5 | |
| High | CVE-2021-41109 | LiveQuery publishes user session tokens | 7.5 | |
| Critical | CVE-2026-31856 | Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL | 9.8 | |
| Critical | CVE-2026-31871 | Parse-community Parse-server: SQL Injection | 9.8 | |
| Critical | CVE-2026-31840 | Parse Server has a SQL injection via dot-notation field name in PostgreSQL | 9.8 | |
| High | CVE-2022-31089 | Invalid file request can crashe parse-server | 7.5 | |
| Critical | CVE-2026-30966 | Parse Server role escalation and CLP bypass via direct `_Join` table write | 10.0 | |
| Critical | CVE-2026-33409 | Parse Server: Auth provider validation bypass on login via partial authData | 9.1 | |
| High | CVE-2026-30939 | Parse-community Parse-server: Prototype Pollution | 7.5 | |
| High | CVE-2026-32944 | Parse Server crash via deeply nested query condition operators | 7.5 | |
| High | CVE-2026-32886 | Parse Server's Cloud function dispatch crashes server via prototype chain traversal | 7.5 |