Parseplatform Parse-Server vulnerabilities
102 published vulnerabilities in Parseplatform Parse-Server. The most were published in 2026 (70), and 70 so far in 2026.
Parseplatform Parse-Server vulnerabilities by year
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Parseplatform Parse-Server vulnerabilities
- CVE-2026-30966 Parse Server role escalation and CLP bypass via direct `_Join` table write
- CVE-2024-27298 Parse Server literalizeRegexPart SQL Injection
- CVE-2022-24760 Command Injection in Parse server
- CVE-2026-30965 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
- CVE-2023-36475 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
- CVE-2022-39396 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
- CVE-2026-32248 Parse Server: Account takeover via operator injection in authentication data identifier
- CVE-2026-31840 Parse Server has a SQL injection via dot-notation field name in PostgreSQL
- CVE-2026-31856 Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
- CVE-2026-31871 Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
- CVE-2026-30863 Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
- CVE-2026-27804 Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.