Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.8	CVE-2026-116165	Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116165Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key... Executive summary A flaw in Parse Server, a backend framework, lets clients without the master key delete class schemas on MongoDB deployments. The advisory rates it High (CVSS v4 8.8) and says deleted schemas also remove class-level permissions and protected fields, which can expose or modify data. Technical summary This is a missing authorization flaw (CWE-862) in Parse Server on MongoDB deployments. A remote, unauthenticated client without the master key can delete the stored schema of any class through the REST API, removing field definitions, class-level permissions and protected fields; object ACLs still apply. The advisory lists affected versions as >= 9.0.0, < 9.10.4-alpha.4 and < 8.6.101, with patched versions 9.10.4-alpha.4 and 8.6.101. PostgreSQL deployments are stated to be unaffected. The vendor's workaround is to register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. The advisory states that upgrading does not restore already deleted schemas, so administrators should review and restore permissions, protected fields and field definitions. No CVE ID is assigned in the advisory, and no detection guidance or known exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116164	Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116164Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal... Executive summary Parse Server, a Node.js backend framework, has a flaw that lets clients write objects with reserved internal field names. On MongoDB deployments this can make reads of affected objects fail for all users of that class, and any user can clear internal account lockout or password history fields on their own account. The advisory rates the issue Moderate and recommends upgrading to Parse Server 8.6.100 or 9.10.4-alpha.3, or applying a beforeSave Cloud Code trigger workaround. Technical summary The weakness is CWE-20, Improper Input Validation, where Parse Server does not reject reserved internal field names in client object writes. The attack is network based with low complexity and requires no privileges or user interaction, but the attacker must be allowed to create objects in a class, and the advisory notes the MongoDB-specific read failure. Affected versions are stated as >= 9.0.0 and < 9.10.4-alpha.3, and < 8.6.100, with patched versions 9.10.4-alpha.3 and 8.6.100. The documented workaround is registering a beforeSave Cloud Code trigger for every writable class, including _User, which discards reserved field names; existing bad fields must be removed directly in MongoDB. The advisory does not state any detection guidance, and it does not state whether the issue is exploited in the wild. CVSS v4 base score is shown as 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. No CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Critical	9.1	CVE-2026-116163	Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116163Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... Executive summary A flaw in Parse Server, a server framework for building app backends, lets attackers bypass authentication when an app uses a custom authentication adapter built as a subclass of AuthAdapter. The advisory rates it Critical with a CVSS 9.1 score and says the fix is to upgrade to Parse Server 8.6.102 or 9.10.5-alpha.2, or to rework custom adapters as described in the workarounds. Technical summary The weakness is classified as CWE-287, Improper Authentication. Custom adapters that extend AuthAdapter never had their validateSetUp, validateLogin, and validateUpdate methods called, so the inherited default accepting any authData was used instead. The advisory states the attack is network-based with low complexity and no privileges or user interaction required, and that an attacker can sign up, link an identity, or log in as an existing user without valid credentials. Affected versions are stated as 9.0.0 up to but not including 9.10.5-alpha.2, and versions before 8.6.102; patched versions are 9.10.5-alpha.2 and 8.6.102. Workarounds are to implement all validation in an overridden validateAuthData method that does not rely on adapter instance state, or to define the adapter as a plain object. The advisory does not state any detection guidance or indicators of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.1	CVE-2026-116162	Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116162Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code Executive summary Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 let a user with SMS multi-factor authentication enabled change restricted fields on their own account. The advisory rates the severity as Low, with a CVSS v4 score of 2.1. Technical summary The flaw is classified as CWE-269, Improper Privilege Management. When requesting an SMS MFA login verification code, Parse Server saved the entire login request with master privileges, so extra account fields in that request were persisted, bypassing write restrictions such as beforeSave triggers. Exploitation requires an account enrolled in SMS MFA and high privileges as listed in the CVSS vector, and it is limited to the requester's own account. Affected versions are stated as greater than or equal to 9.0.0 and less than 9.10.5-alpha.5, and less than 8.6.104; patched versions are 9.10.5-alpha.5 and 8.6.104. The advisory states there is no configuration workaround and recommends upgrading. No detection guidance is stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/parse-community/parse-server/security/advisories/GHSA-9rh6-r4ph-367v Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.0	CVE-2026-116161	Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116161Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery Executive summary Parse Server, a Node.js backend package, has an information disclosure flaw in its LiveQuery feature. Subscriptions that use a $or query can receive another user's events, including session tokens, which could let an attacker act as another user. The advisory rates it Moderate and recommends upgrading to a patched version (9.10.5-alpha.4 or 8.6.103). Technical summary The flaw is CWE-200 (exposure of sensitive information to an unauthorized actor) in Parse Server's LiveQuery. The subscription hash omits query constraints placed next to a $or operator, including the server-added _Session owner filter and constraints added by beforeSubscribe triggers, so different clients can be grouped into one subscription and receive each other's events. The advisory lists network attack vector, low attack complexity, low privileges required, no user interaction, and a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, with an overall score of 6.0. Affected versions are >= 9.0.0 and < 9.10.5-alpha.4, and <= 8.6.102; patched versions are 9.10.5-alpha.4 and 8.6.103. Workarounds are to protect sensitive classes with ACL or class-level permissions, avoid $or in _Session subscriptions, and avoid $or where isolation depends on constraints beside it. The advisory does not state any detection guidance, and it lists no CVE ID. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.3	CVE-2026-112769	Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions parse-communityparse-community parse-server	NVD	Oct 19 20:17 UTC
CVE-2026-112769Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions From the advisory Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session; these sessions are not revoked when the original session is logged out. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 19, 2026 20:17 UTC Read the advisory
	Medium	6.9	CVE-2026-112768	Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their... parse-communityparse-community parse-server	NVD	Oct 19 20:17 UTC
CVE-2026-112768Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their... From the advisory Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 19, 2026 20:17 UTC Read the advisory
	High	8.2	CVE-2026-110854	Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit parse-communityparse-community parse-server	NVD	Oct 14 23:17 UTC
CVE-2026-110854Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit From the advisory Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 14, 2026 23:17 UTC Read the advisory
	High	8.3	CVE-2026-109954	Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request... parse-communityparse-community parse-server	NVD	Oct 13 14:17 UTC
CVE-2026-109954Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request... From the advisory Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 13, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-109303	Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using... parse-communityparse-community parse-server	NVD	Oct 12 17:17 UTC
CVE-2026-109303Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using... From the advisory Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can combine counts with an objectId constraint as a membership oracle to reveal confidential memberships such as private groups or block lists. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	6.3	CVE-2026-109302	Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to... parse-communityparse-community parse-server	NVD	Oct 12 17:17 UTC
CVE-2026-109302Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to... From the advisory Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	High	8.2	CVE-2026-109301	Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing... parse-communityparse-community parse-server	NVD	Oct 12 17:17 UTC
CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing... From the advisory Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 12, 2026 17:17 UTC Read the advisory
	Medium	6.3	CVE-2026-105828	Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden... parse-communityparse-community parse-server	NVD	Oct 8 15:17 UTC
CVE-2026-105828Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden... From the advisory Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Oct 8, 2026 15:17 UTC Read the advisory
	High	7.4	CVE-2026-101042	Parse Server is an open-source backend server parse-communityparse-community parse-server	NVD	Sep 27 17:16 UTC
CVE-2026-101042Parse Server is an open-source backend server From the advisory Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) verify the client's authorization code with the external provider on signup and on provider linking, but not when authentication data is supplied together with a username and password on the login endpoint. As a result, a low-privileged authenticated user can attach an arbitrary, unverified provider identity to their own account without the provider ever being contacted, spoofing an external identity toward application logic that trusts the linked provider ID. An attacker can also pre-hijack accounts: by claiming the provider ID of a victim who has not yet linked that provider, the victim's later legitimate sign-in with that provider resolves to the attacker's account. Only deployments configuring one of the affected code-based auth adapters are impacted. Versions 9.10.1-alpha.10 and 8.6.91 fix the issue by running the adapter's credential verification on the login and challenge endpoints and rejecting a provider identity already linked to another user. As a workaround, disable the affected code-based auth adapters. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Sep 27, 2026 17:16 UTC Read the advisory
	High	7.1	CVE-2026-100632	Parse Server is an open-source backend server parse-communityparse-community parse-server	NVD	Sep 26 14:16 UTC
CVE-2026-100632Parse Server is an open-source backend server From the advisory Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public () group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public () group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Sep 26, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-100631	Parse Server is an open source backend server parse-communityparse-community parse-server	NVD	Sep 26 14:16 UTC
CVE-2026-100631Parse Server is an open source backend server From the advisory Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community parse-community parse-server NIST National Vulnerability DatabasePublished Sep 26, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects