parse-server has 8 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 7 in the 90 before. The busiest recent month was June 2026 with 7. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- —
- Publish → KEV
- —
- Last 90 days
- 0 prev 7
Worst active — by depth score
GHSA-cgxm-vr2f-6fj8Highparse-server: Denial of service via exponential-time processing of deeply nested query operators41CVE-2026-53726Mediumparse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL28CVE-2026-53725Mediumparse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied28CVE-2026-50008Mediumparse-server: Server option routeAllowList is bypassable through batch sub-requests28CVE-2026-32594MediumParse Server's GraphQL WebSocket endpoint bypasses security middleware28
parse-server vulnerabilities
CVEs affecting parse-server, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
GHSA-cgxm-vr2f-6fj8Highparse-server: Denial of service via exponential-time processing of deeply nested query operators
parse-server: Denial of service via exponential-time processing of deeply nested query operators
CVE-2026-50008Mediumparse-server: Server option routeAllowList is bypassable through batch sub-requests
parse-server: Server option routeAllowList is bypassable through batch sub-requests
CVE-2026-53724Lowparse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
CVE-2026-53725Mediumparse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
CVE-2026-53726Mediumparse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
CVE-2026-55778Lowparse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
GHSA-97pr-9hgg-3p8rLowparse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
CVE-2026-32594MediumParse Server's GraphQL WebSocket endpoint bypasses security middleware
Parse Server's GraphQL WebSocket endpoint bypasses security middleware