Repository navigation
Security: parse-community/parse-server
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Save response reveals whether a field is stored to a caller without read accessGHSA-ch64-8phh-m7hc published
Oct 23, 2026 by mtrezzaLow -
Object create returns field values to a caller without read accessGHSA-qq3r-ppqq-rh6m published
Oct 21, 2026 by mtrezzaLow -
Session upgrade endpoint creates an additional session from an already revocable session tokenGHSA-2j2x-c587-q33g published
Oct 20, 2026 by mtrezzaLow -
Object update with a dot notation key below a pointer field can terminate the server processGHSA-wc3c-6843-q7mv published
Oct 19, 2026 by mtrezzaHigh -
Pre-authentication denial of service via email address format regex backtrackingGHSA-9492-427f-466x published
Oct 22, 2026 by mtrezzaHigh -
Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQueryGHSA-95hp-82c6-25q5 published
Oct 20, 2026 by mtrezzaModerate -
Object write with a null dot notation key can corrupt a field or make reads fail on MongoDBGHSA-655c-2xf3-77x9 published
Oct 19, 2026 by mtrezzaModerate -
Object update returns stored field values to a caller without read accessGHSA-2rcp-jc67-vq74 published
Oct 18, 2026 by mtrezzaLow -
Object write with a crafted key can pollute a shared prototype and cause denial of serviceGHSA-rx55-fw4j-pvpx published
Oct 15, 2026 by mtrezzaModerate -
Object update returns the stored value of a field reverted in `beforeSave` to a caller without read accessGHSA-9rvr-f5hc-9f2f published
Oct 15, 2026 by mtrezzaLow