Medium
CVE-2026-30850
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 117
Reset filters
Medium
CVE-2026-30848
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
Medium
CVE-2026-30835
parse-server: Malformed `$regex` query leaks database error details in API response
High
CVE-2026-30229
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Medium
CVE-2026-30228
parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction
High
CVE-2026-29182
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
Critical
CVE-2026-27804
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
High
CVE-2025-68150
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
Medium
CVE-2025-68115
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Medium
CVE-2025-64502
Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details
High
CVE-2025-64430
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
Medium
CVE-2025-53364
Parse Server exposes the data schema via GraphQL API
Medium
CVE-2025-30168
Parse Server has an OAuth login vulnerability
High
CVE-2024-47183
Parse Server's custom object ID allows to acquire role privileges
Critical
CVE-2024-39309
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
Critical
CVE-2024-29027
Server crashes on invalid Cloud Function or Cloud Job name
Critical
CVE-2024-27298
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
High
CVE-2023-46119
Parse Server may crash when uploading file without extension
High
CVE-2023-41058
Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
Critical
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Medium
CVE-2023-32689
Phishing attack vulnerability by uploading malicious HTML file
Medium
CVE-2023-32688
Invalid push request payload crashes Parse Server
High
CVE-2023-22474
Parse Server option `masterKeyIps` vulnerability to IP spoofing
High
CVE-2022-41879
Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.