CVE-2026-121415Low· 3.7▾ SunlitParse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any clie…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.
parse-server >= 9.0.0 < 9.10.6-alpha.3parse-server < 8.6.111Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116164Medium· 6.3Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
CVE-2026-123487High· 7.5Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex
CVE-2026-120310Low· 3.1Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
CVE-2026-122301Low· 3.1Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
CVE-2026-119571Low· 3.7Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
CVE-2026-121965Medium· 5.3Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key