High
CVE-2026-33539
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 117
Reset filters
High
CVE-2026-33538
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
Medium
CVE-2026-33527
Parse Server's Session Update endpoint allows overwriting server-generated session fields
High
CVE-2026-33508
Parse Server LiveQuery subscription query depth bypass
High
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Medium
CVE-2026-33429
Parse Server has a protected field change detection oracle via LiveQuery watch parameter
High
CVE-2026-33421
Parse Server's LiveQuery bypasses CLP pointer permission enforcement
High
CVE-2026-33409
Parse Server has an auth provider validation bypass on login via partial authData
Medium
CVE-2026-33323
Parse Server email verification resend page leaks user existence
High
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Medium
CVE-2026-33042
Parse Server affected by empty authData bypassing credential requirement on signup
Medium
CVE-2026-32770
Parse Server LiveQuery subscription with invalid regular expression crashes server
Medium
CVE-2026-32742
Parse Server session creation endpoint allows overwriting server-generated session fields
Medium
CVE-2026-32878
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
High
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Low
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
High
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
High
CVE-2026-32728
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Medium
CVE-2026-32594
Parse Server's GraphQL WebSocket endpoint bypasses security middleware
Medium
CVE-2026-32269
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
Critical
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
Critical
CVE-2026-32242
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
Medium
CVE-2026-32234
Parse Server has a SQL injection via query field name when using PostgreSQL
Medium
CVE-2026-32098
Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.