PT-2026-99303

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.1-alpha.7 Parse Server versions prior to 8.6.89 Description LiveQuery evaluates the protectedFields class-level permission using an incompletely resolved caller identity. Because subscriber roles are no...

CVE-2026-100631: Improper Neutralization of Special Elements in Data Query Logic

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100632: Exposure of Sensitive Information to an Unauthorized Actor

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

BIT-PARSE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server versions = 9.0.0 9.10.1 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proo...

BIT-PARSE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...

BIT-PARSE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these errors are...

BIT-PARSE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

BIT-PARSE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

PT-2026-99011

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...

PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

Linux Distros Unpatched Vulnerability : CVE-2026-93223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: media: tegra-video: fix ofnodeput on VIP parse errors tegravipchannelofparse initializes np from dev-ofnode without taking a reference, but its error...

PT-2026-99010

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these errors are...

PT-2026-99009

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

PT-2026-99012

Parse Server versions = 9.0.0 9.10.1 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proo...

PT-2026-98776

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ksmbd module fails to properly handle errors during the parsing of Discretionary Access Control Lists DACL, which are lists that specify which users or groups are granted access to a...

PT-2026-98500

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read of one byte occurs in the smb2 parse native symlink function when parsing a share-root relative native symlink. The issue arises because memcpy copies data starting...

PT-2026-98758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the af packet module where the tpacket parse header function incorrectly casts the user-provided tpacket hdr.tp len variable, which is a u32 unsigned 32-bit integer, t...

SUSE CVE-2026-97426

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...