# parse-community parse-server.

Every CVE that names parse-community parse-server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response](https://agentprime.io/advisories/CVE-2026-122301.md)
  `CVE-2026-122301` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure
- [Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key](https://agentprime.io/advisories/CVE-2026-121965.md)
  `CVE-2026-121965` · CVE record: parse-community parse-server · CVSS 6.0 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Prototype pollution
- [Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key](https://agentprime.io/advisories/CVE-2026-121415.md)
  `CVE-2026-121415` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update](https://agentprime.io/advisories/CVE-2026-121414.md)
  `CVE-2026-121414` · CVE record: parse-community parse-server · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-248
- [Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession](https://agentprime.io/advisories/CVE-2026-121413.md)
  `CVE-2026-121413` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response](https://agentprime.io/advisories/CVE-2026-120310.md)
  `CVE-2026-120310` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure
- [Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID](https://agentprime.io/advisories/CVE-2026-119571.md)
  `CVE-2026-119571` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses](https://agentprime.io/advisories/CVE-2026-119570.md)
  `CVE-2026-119570` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service](https://agentprime.io/advisories/CVE-2026-119569.md)
  `CVE-2026-119569` · CVE record: parse-community parse-server · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Prototype pollution
- [Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys](https://agentprime.io/advisories/CVE-2026-119126.md)
  `CVE-2026-119126` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-754
- [Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields](https://agentprime.io/advisories/CVE-2026-119125.md)
  `CVE-2026-119125` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query](https://agentprime.io/advisories/CVE-2026-116801.md)
  `CVE-2026-116801` · CVE record: parse-community parse-server · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB](https://agentprime.io/advisories/CVE-2026-116165.md)
  `CVE-2026-116165` · CVE record: parse-community parse-server · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes](https://agentprime.io/advisories/CVE-2026-116164.md)
  `CVE-2026-116164` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses](https://agentprime.io/advisories/CVE-2026-116163.md)
  `CVE-2026-116163` · CVE record: parse-community parse-server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login](https://agentprime.io/advisories/CVE-2026-116162.md)
  `CVE-2026-116162` · CVE record: parse-community parse-server · CVSS 2.1 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Privilege escalation
- [Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions](https://agentprime.io/advisories/CVE-2026-116161.md)
  `CVE-2026-116161` · CVE record: parse-community parse-server · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass](https://agentprime.io/advisories/CVE-2026-112769.md)
  `CVE-2026-112769` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update](https://agentprime.io/advisories/CVE-2026-112768.md)
  `CVE-2026-112768` · CVE record: parse-community parse-server · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error](https://agentprime.io/advisories/CVE-2026-110854.md)
  `CVE-2026-110854` · CVE record: parse-community parse-server · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-248
- [Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference](https://agentprime.io/advisories/CVE-2026-109954.md)
  `CVE-2026-109954` · CVE record: parse-community parse-server · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query](https://agentprime.io/advisories/CVE-2026-109303.md)
  `CVE-2026-109303` · CVE record: parse-community parse-server · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries](https://agentprime.io/advisories/CVE-2026-109302.md)
  `CVE-2026-109302` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL](https://agentprime.io/advisories/CVE-2026-109301.md)
  `CVE-2026-109301` · CVE record: parse-community parse-server · CVSS 8.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-248
- [Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors](https://agentprime.io/advisories/CVE-2026-105828.md)
  `CVE-2026-105828` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity](https://agentprime.io/advisories/CVE-2026-101042.md)
  `CVE-2026-101042` · CVE record: parse-community parse-server · CVSS 7.4 High · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery](https://agentprime.io/advisories/CVE-2026-100632.md)
  `CVE-2026-100632` · CVE record: parse-community parse-server · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection](https://agentprime.io/advisories/CVE-2026-100631.md)
  `CVE-2026-100631` · CVE record: parse-community parse-server · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Other injection
- [Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password](https://agentprime.io/advisories/CVE-2026-87806.md)
  `CVE-2026-87806` · CVE record: parse-community parse-server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Authentication bypass
- [Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages](https://agentprime.io/advisories/CVE-2026-66009.md)
  `CVE-2026-66009` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages](https://agentprime.io/advisories/CVE-2026-66008.md)
  `CVE-2026-66008` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion](https://agentprime.io/advisories/CVE-2026-64627.md)
  `CVE-2026-64627` · CVE record: parse-community parse-server · CVSS 6.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure
- [Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management](https://agentprime.io/advisories/CVE-2025-67727.md)
  `CVE-2025-67727` · CVE record: parse-community parse-server · CVSS 6.9 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection, Privilege escalation

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=parse-community-parse-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/parse-community-parse-server/>. Everything for agents: <https://agentprime.io/llms.txt>.