EUVD-2026-115946

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-121414: parse-community parse-server: Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object…

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-119126 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade...

CVE-2026-119126

Parse Server versions before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 are vulnerable to a flaw where the system mishandles dot notation keys containing null or undefined values during object construction. While the write operation is successfully stored, the system returns an error and skips after...

CVE-2026-119126 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade...

Parse Platform parse-server improper exception handling vulnerability

Versions prior to 8.6.106 and versions 9.0.0 through 9.10.5-alpha.7 of the Parse Platform contain an improper exception handling vulnerability. This vulnerability arises from inadequate handling of null or undefined point notation keys when storing objects; as a result, writes are stored but...