Low
CVE-2026-57481
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 117
Reset filters
Low
CVE-2026-55778
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
Medium
CVE-2026-53726
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Medium
CVE-2026-53725
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Low
CVE-2026-53724
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
Medium
CVE-2026-50008
parse-server: Server option routeAllowList is bypassable through batch sub-requests
High
CVE-2026-57480
parse-server: Denial of service via exponential-time processing of deeply nested query operators
Medium
CVE-2026-47248
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers
High
CVE-2026-47138
Parse Server: Pre-authentication denial of service via client version header regex backtracking
Low
CVE-2026-43930
parse-server: MFA SMS one-time password accepted twice under concurrent login
Medium
CVE-2026-39381
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Medium
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Low
CVE-2026-35200
Parse Server: File upload Content-Type override via extension mismatch
High
CVE-2026-34784
Parser Server's streaming file download bypasses afterFind file trigger authorization
Medium
CVE-2026-34595
Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value
Medium
CVE-2026-34574
Parse Server has a session field immutability bypass via falsy-value guard
High
CVE-2026-34573
parse-server has GraphQL complexity validator exponential fragment traversal DoS
Critical
CVE-2026-34532
parse-server has cloud function validator bypass via prototype chain traversal
Medium
CVE-2026-34373
GraphQL API endpoint ignores CORS origin restriction
High
CVE-2026-34363
LiveQuery protected field leak via shared mutable state across concurrent subscribers
Low
CVE-2026-34224
Parse Server has an MFA single-use token bypass via concurrent authData login requests
High
CVE-2026-34215
Parse Server exposes auth data via verify password endpoint
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
Low
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.