72
CVEs
18
Critical
30
High
0
KEV
5
PoC
0
Unpatched C/H
100.0%
Patch Rate
1.6%
Avg EPSS
Severity Breakdown
CRITICAL
18
HIGH
30
MEDIUM
21
LOW
3
Monthly CVE Trend
Affected Products (12)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-24760 | Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 10.0 | 49.1% | 70 |
PoC
|
| CVE-2026-32248 | Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2026-30965 | Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications. | CRITICAL | 9.1 | 0.0% | 66 |
PoC
|
| CVE-2026-32242 | ### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy. Deployments that configure multiple OAuth2 providers via the `oauth2: true` flag are affected. ### Patches The fix ensures that a new adapter instance is created for each provider instead of reusing the singleton, so each provider's configuration is isolated. ### Workarounds There is no known workaround. If only a single OAuth2 provider is configured, the race condition cannot occur. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.37 | HIGH | 7.4 | 0.1% | 57 |
PoC
|
| CVE-2025-57324 | parse is a package designed to parse JavaScript SDK. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-30966 | Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions. | CRITICAL | 10.0 | 0.0% | 50 |
|
| CVE-2024-27298 | parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database. | CRITICAL | 10.0 | 1.0% | 50 |
|
| CVE-2026-27595 | Unauthenticated arbitrary database read/write in Parse Dashboard's AI Agent endpoint (POST /apps/:appId/agent) lets remote attackers operate against any connected Parse Server using the master key. Affected builds span the 7.3.0-alpha.42 through 9.0.0-alpha.7 pre-releases, but only deployments that have explicitly enabled the opt-in agent feature are exposed. No public exploit identified at time of analysis, and EPSS is very low (0.04%), but the chained authentication/CSRF/authorization gaps make exploitation trivial where the feature is configured. | CRITICAL | 9.9 | 0.0% | 50 |
|
| CVE-2026-30863 | Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popular open-source backend framework for mobile and web applications. | CRITICAL | 9.8 | 0.1% | 49 |
|
| CVE-2026-31840 | SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-31856 | SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-31871 | SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2022-39396 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 38.7% | 49 |
|
| CVE-2022-41879 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.8% | 49 |
|
| CVE-2022-41878 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.9% | 49 |
|