Skip to content
Noroxi

parseplatform records

109 published records for vendor parseplatform.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
99.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

109 records
  • CVE-2022-24760
    55Plan

    Command Injection in Parse server

    CriticalCVSS 10.0Proof of conceptEPSS 49%

    parseplatform · parse-serverMar 11, 2022

  • CVE-2022-39396
    51Plan

    Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

    CriticalCVSS 9.8No exploitEPSS 39%

    parseplatform · parse-serverNov 9, 2022

  • CVE-2023-36475
    40Plan

    Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

    CriticalCVSS 9.8No exploitEPSS 3%

    parseplatform · parse-serverJun 28, 2023

  • CVE-2024-27298
    40Plan

    Parse Server literalizeRegexPart SQL Injection

    CriticalCVSS 10.0No exploitEPSS 1%

    parseplatform · parse-serverMar 1, 2024

  • CVE-2026-30966
    40Plan

    Parse Server role escalation and CLP bypass via direct `_Join` table write

    CriticalCVSS 10.0No exploitEPSS 1%

    parseplatform · parse-serverMar 10, 2026

  • CVE-2026-30965
    39Monitor

    Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

    CriticalCVSS 9.9Proof of conceptEPSS 2%

    parseplatform · parse-serverMar 10, 2026

  • CVE-2022-41878
    39Monitor

    Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers

    CriticalCVSS 9.8No exploitEPSS 1%

    parseplatform · parse-serverNov 10, 2022

  • CVE-2022-41879
    39Monitor

    Parse Server subject to Prototype pollution via Cloud Code Webhooks

    CriticalCVSS 9.8No exploitEPSS 1%

    parseplatform · parse-serverNov 10, 2022

  • CVE-2026-27595
    39Monitor

    Parse Dashboard has incomplete authentication on AI Agent endpoint

    CriticalCVSS 9.9No exploitEPSS 1%

    parseplatform · parse dashboardFeb 24, 2026

  • CVE-2026-32248
    37Monitor

    Parse Server: Account takeover via operator injection in authentication data identifier

    CriticalCVSS 9.3No exploitEPSS 1%

    parseplatform · parse-serverMar 12, 2026

  • CVE-2026-31840
    37Monitor

    Parse Server has a SQL injection via dot-notation field name in PostgreSQL

    CriticalCVSS 9.3No exploitEPSS 1%

    parseplatform · parse-serverMar 11, 2026

  • CVE-2026-30863
    37Monitor

    Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    parseplatform · parse-serverMar 7, 2026

  • CVE-2026-31856
    37Monitor

    Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL

    CriticalCVSS 9.3No exploitEPSS 1%

    parseplatform · parse-serverMar 11, 2026

  • CVE-2026-31871
    37Monitor

    Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

    CriticalCVSS 9.3No exploitEPSS 1%

    parseplatform · parse-serverMar 11, 2026

  • CVE-2026-27608
    37Monitor

    Parse Dashboard Missing Authorization on Agent Endpoint

    CriticalCVSS 9.3No exploitEPSS 0%

    parseplatform · parse dashboardFeb 24, 2026

  • CVE-2026-27804
    37Monitor

    Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

    CriticalCVSS 9.3No exploitEPSS 0%

    parseplatform · parse-serverFeb 25, 2026

  • CVE-2024-29027
    36Monitor

    Parse Server crash and RCE via invalid Cloud Function or Cloud Job name

    CriticalCVSS 9.0No exploitEPSS 1%

    parseplatform · parse-serverMar 19, 2024

  • CVE-2026-34532
    36Monitor

    Parse Server: Cloud function validator bypass via prototype chain traversal

    CriticalCVSS 9.1No exploitEPSS 0%

    parseplatform · parse-serverMar 31, 2026

  • CVE-2026-32242
    36Monitor

    Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

    CriticalCVSS 9.1No exploitEPSS 0%

    parseplatform · parse-serverMar 12, 2026

  • CVE-2026-30939
    35Monitor

    Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

    HighCVSS 8.8No exploitEPSS 1%

    parseplatform · parse-serverMar 10, 2026

  • CVE-2026-31800
    35Monitor

    Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

    HighCVSS 8.8No exploitEPSS 1%

    parseplatform · parse-serverMar 10, 2026

  • CVE-2026-33538
    34Monitor

    Parse Server: Denial of service via unindexed database query for unconfigured auth providers

    HighCVSS 8.7No exploitEPSS 1%

    parseplatform · parse-serverMar 24, 2026

  • CVE-2026-33539
    34Monitor

    Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

    HighCVSS 8.6No exploitEPSS 1%

    parseplatform · parse-serverMar 24, 2026

  • CVE-2026-30946
    34Monitor

    Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

    HighCVSS 8.7No exploitEPSS 1%

    parseplatform · parse-serverMar 10, 2026

  • CVE-2026-33498
    34Monitor

    Parse Server: Query condition depth bypass via pre-validation transform pipeline

    HighCVSS 8.7No exploitEPSS 1%

    parseplatform · parse-serverMar 24, 2026