42
CVEs
11
Critical
16
High
0
KEV
4
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
16
MEDIUM
14
LOW
1
Monthly CVE Trend
Affected Products (12)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-32248 | Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2026-30965 | Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications. | CRITICAL | 9.1 | 0.0% | 66 |
PoC
|
| CVE-2026-32242 | ### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy. Deployments that configure multiple OAuth2 providers via the `oauth2: true` flag are affected. ### Patches The fix ensures that a new adapter instance is created for each provider instead of reusing the singleton, so each provider's configuration is isolated. ### Workarounds There is no known workaround. If only a single OAuth2 provider is configured, the race condition cannot occur. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.37 | HIGH | 7.4 | 0.1% | 57 |
PoC
|
| CVE-2025-57324 | parse is a package designed to parse JavaScript SDK. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-30966 | Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions. | CRITICAL | 10.0 | 0.0% | 50 |
|
| CVE-2026-27595 | Unauthenticated arbitrary database read/write in Parse Dashboard's AI Agent endpoint (POST /apps/:appId/agent) lets remote attackers operate against any connected Parse Server using the master key. Affected builds span the 7.3.0-alpha.42 through 9.0.0-alpha.7 pre-releases, but only deployments that have explicitly enabled the opt-in agent feature are exposed. No public exploit identified at time of analysis, and EPSS is very low (0.04%), but the chained authentication/CSRF/authorization gaps make exploitation trivial where the feature is configured. | CRITICAL | 9.9 | 0.0% | 50 |
|
| CVE-2026-30863 | Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popular open-source backend framework for mobile and web applications. | CRITICAL | 9.8 | 0.1% | 49 |
|
| CVE-2026-31840 | SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-31856 | SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-31871 | SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-27608 | Broken authorization in Parse Dashboard's AI Agent endpoint (POST /apps/:appId/agent) lets any authenticated user reach apps they are not scoped to and lets read-only users escalate to full read-write control. Present in versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the endpoint omits per-app authorization checks and hands read-only users the full master key, so an attacker can swap the app ID in the URL to act against other tenants and supply write permissions to perform write/delete operations. No public exploit is identified at time of analysis, and the EPSS probability is very low (0.03%), but it is trivially exploitable by any logged-in low-privilege user where the agent feature is enabled. | CRITICAL | 9.3 | 0.0% | 47 |
|
| CVE-2026-31800 | Parse Server has a third vulnerability with missing authorization enabling unauthorized operations. | CRITICAL | 9.1 | 0.1% | 46 |
|
| CVE-2026-27804 | Weak cryptographic algorithm in Parse Server before 8.6.3/9.1.1-alpha.4 allows attackers to bypass security mechanisms. Patch available. | CRITICAL | 9.1 | 0.0% | 46 |
|
| CVE-2026-31828 | Parse Server's LDAP authentication adapter fails to properly sanitize user input in Distinguished Names and group filters, allowing authenticated attackers to inject LDAP commands and bypass group-based access controls. This vulnerability enables privilege escalation for any valid LDAP user to gain membership in restricted groups, affecting deployments that rely on LDAP group policies for authorization. Patches are available in versions 9.5.2-alpha.13 and 8.6.26. | HIGH | 8.8 | 0.1% | 44 |
|
| CVE-2026-30967 | Parse Server versions prior to 9.5.2-alpha.9 and 8.6.22 fail to properly validate OAuth2 token ownership when the useridField option is not configured, allowing attackers with any valid token from the same provider to impersonate arbitrary users. This authentication bypass affects all Parse Server deployments using the generic OAuth2 adapter without the useridField setting. The vulnerability is resolved in patched versions 9.5.2-alpha.9 and 8.6.22. | HIGH | 8.8 | 0.1% | 44 |
|