CVE-2026-116165

Parse Server versions before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 are vulnerable to a missing authorization flaw on MongoDB deployments. This allows unauthenticated attackers to send REST API delete requests targeting the internal _SCHEMA collection. Successful exploitation enables the deletio...

EUVD-2026-109426

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

WordPress Rank Math SEO plugin <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Schema Deletion vulnerability discovered by Webbernaut in WordPress Plugin Rank Math SEO versions = 1.0.235...