Known Vulnerabilities for Parse-server by Parseplatform
Listed below are 10 of the newest known vulnerabilities associated with "Parse-server" by "Parseplatform".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-116801 json | Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relat... | Not Provided | 2026-10-27 | 2026-10-27 |
| CVE-2026-116165 json | Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deploym... | Not Provided | 2026-10-25 | 2026-10-25 |
| CVE-2026-116164 json | Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object wr... | Not Provided | 2026-10-25 | 2026-10-25 |
| CVE-2026-116163 json | Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, vali... | Not Provided | 2026-10-25 | 2026-10-26 |
| CVE-2026-116162 json | Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuin... | Not Provided | 2026-10-25 | 2026-10-25 |
| CVE-2026-116161 json | Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. It... | Not Provided | 2026-10-25 | 2026-10-25 |
| CVE-2026-115700 json | Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-enco... | Not Provided | 2026-10-26 | 2026-10-26 |
| CVE-2026-112947 json | Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of ... | Not Provided | 2026-10-20 | 2026-10-21 |
| CVE-2026-112769 json | Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions o... | Not Provided | 2026-10-19 | 2026-10-20 |
| CVE-2026-112768 json | Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update b... | Not Provided | 2026-10-19 | 2026-10-19 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Parseplatform | Parse-server | 4.9.3 | |||
| Application | Parseplatform | Parse-server | 4.9.2 | |||
| Application | Parseplatform | Parse-server | 4.9.1 | |||
| Application | Parseplatform | Parse-server | 4.9.0 | |||
| Application | Parseplatform | Parse-server | 4.8.5 | |||
| Application | Parseplatform | Parse-server | 4.8.4 | |||
| Application | Parseplatform | Parse-server | 4.8.3 | |||
| Application | Parseplatform | Parse-server | 4.8.2 | |||
| Application | Parseplatform | Parse-server | 4.8.1 | |||
| Application | Parseplatform | Parse-server | 4.8.0 | |||
| Application | Parseplatform | Parse-server | 4.7.0 | |||
| Application | Parseplatform | Parse-server | 4.6.0 | |||
| Application | Parseplatform | Parse-server | 4.5.0 | |||
| Application | Parseplatform | Parse-server | 4.4.0 | |||
| Application | Parseplatform | Parse-server | 4.3.0 | |||
| Application | Parseplatform | Parse-server | 4.2.0 | |||
| Application | Parseplatform | Parse-server | 4.1.0 | |||
| Application | Parseplatform | Parse-server | 4.1.0 | |||
| Application | Parseplatform | Parse-server | 4.0.9 | |||
| Application | Parseplatform | Parse-server | 4.0.8 |