# Parseplatform Parse-Server


- [CVE-2026-30966](https://insights.sbomify.com/CVE-2026-30966/): Parse Server role escalation and CLP bypass via direct `_Join` table write (critical 10.0)
- [CVE-2024-27298](https://insights.sbomify.com/CVE-2024-27298/): Parse Server literalizeRegexPart SQL Injection (critical 10.0)
- [CVE-2022-24760](https://insights.sbomify.com/CVE-2022-24760/): Command Injection in Parse server (critical 10.0)
- [CVE-2026-30965](https://insights.sbomify.com/CVE-2026-30965/): Parse Server session token exfiltration via `redirectClassNameForKey` query parameter (critical 9.9)
- [CVE-2023-36475](https://insights.sbomify.com/CVE-2023-36475/): Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution (critical 9.8)
- [CVE-2022-39396](https://insights.sbomify.com/CVE-2022-39396/): Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser (critical 9.8)
- [CVE-2026-32248](https://insights.sbomify.com/CVE-2026-32248/): Parse Server: Account takeover via operator injection in authentication data identifier (critical 9.3)
- [CVE-2026-31840](https://insights.sbomify.com/CVE-2026-31840/): Parse Server has a SQL injection via dot-notation field name in PostgreSQL (critical 9.3)
- [CVE-2026-31856](https://insights.sbomify.com/CVE-2026-31856/): Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL (critical 9.3)
- [CVE-2026-31871](https://insights.sbomify.com/CVE-2026-31871/): Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL (critical 9.3)
- [CVE-2026-30863](https://insights.sbomify.com/CVE-2026-30863/): Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters (critical 9.3)
- [CVE-2026-27804](https://insights.sbomify.com/CVE-2026-27804/): Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/products/parseplatform/parse-server/