These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-66008 is a medium-severity vulnerability in Parse Server that discloses Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled. The vulnerability affects Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87. This vulnerability allows an unauthenticated client to reconstruct hidden [truncated]
CVE-2026-61448 is a stored cross-site scripting (XSS) vulnerability in Parse Server versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. The vulnerability occurs when an uploaded file's extension is not recognized by the mime package, allowing a malformed Content-Type to bypass the fileUpload.fileExtensions blocklist and be stored unchanged. On storage adapters that persist and serve the uploaded Content-Ty [truncated]
A LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83. The vulnerability affects Parse Server prior to 9.9.1-alpha.13 and 8.6.83, and users of Parse Server who util [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-08T21:16:50.890Z and has not been modified since then. This vulnerability affects Parse Server, an open-source backend that can be deployed to any infrastructure running Node.js. The vulnerability is related to deeply nested query condition operators that could trigger exponential-time processing an [truncated]
CVE-2026-55778 is a low-severity vulnerability in Parse Server, an open-source backend service. The issue allows attackers to bypass file extension restrictions, potentially leading to stored cross-site scripting (XSS) attacks. This vulnerability was addressed in Parse Server versions 9.9.1-alpha.11 and 8.6.81. Affected deployments should prioritize updating to these versions or later. Although rated low [truncated]
CVE-2021-47986 is a supply chain vulnerability in Parse Server before version 4.10.0. The vulnerability arises from incorrect version tags pushed to the repository, potentially linking to unreviewed code in a personal fork. Organizations should be aware of the potential for attackers to exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malici [truncated]
CVE-2026-53726 is a vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting client by protectedFields, and even when the object owning the relation was not [truncated]
CVE-2026-53725 is a sensitive data exposure vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. The vulnerability affects versions 9.8.0 to before 9.9.1-alpha.5. Apps that enable Multi-Factor Authentication (MFA) and deny get on the _User class via Class-Level Permissions could expose sensitive user data through the /login and /verifyPassw [truncated]
CVE-2026-53724 is a low-severity vulnerability in Parse Server, an open-source backend. The issue allows an attacker to bypass the default file upload extension blocklist by appending a trailing dot to a filename whose extension would otherwise be blocked. This can lead to stored XSS when a victim opens the file URL. The vulnerability has been patched in versions 8.6.79 and 9.9.1-alpha.4.
CVE-2026-50008 is a security bypass vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. However, the check is only enforced as Express middleware against the outer HTTP request URL, [truncated]
CVE-2026-47248 is a vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure running Node.js. The vulnerability affects the GraphQL endpoint, which discloses schema metadata to unauthenticated callers through 'Did you mean ...?' suggestions embedded in GraphQL validation-error messages. This allows an unauthenticated caller with only the public application ID to ite [truncated]
CVE-2026-47138 is a HIGH-severity vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains adversarial input that triggers polynomial backtracking in a r [truncated]
A race condition in Parse Server's MFA SMS OTP login path allows two concurrent /login requests with the same OTP to both succeed, violating the single-use property of one-time passwords. The vulnerability exists in versions prior to 8.6.76 and 9.9.0-alpha.2. Exploitation requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g., via SIM swap, network mirror, or [truncated]
CVE-2026-39381 is a vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields [truncated]
CVE-2026-35200 is a vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist but with a Content-Type header that differs from the extension. This can lead to storage adapters serving the file with a mismatched Co [truncated]
CVE-2026-34784 is a high-severity vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure that can run Node.js. The vulnerability allows file downloads via HTTP Range requests to bypass the afterFind(Parse.File) trigger and its validators on storage adapters that support streaming, such as the default GridFS adapter. This could allow access to files that should be [truncated]
A vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure running Node.js, allows attackers to extract sensitive authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. This issue was patched in versions 8.6.63 and 9.7.0-alpha.7. The vulnerability affects users who have enabled multi-factor authentication, and attackers who know a [truncated]
CVE-2026-34595 is a medium-severity vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure running Node.js. An authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. This is achieved by sending a subscription with a $or, $and, or $nor operator value as a plain object with numeri [truncated]
CVE-2026-34574 is a vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure running Node.js. An authenticated user can bypass the immutability guard on session fields by sending a null value in a PUT request to the session update endpoint, allowing them to nullify the session expiry and making the session valid indefinitely. This issue has been patched in versions [truncated]
CVE-2026-34573 is a high-severity vulnerability in Parse Server, an open-source backend, that can be exploited to cause a denial-of-service via a crafted GraphQL query with binary fan-out fragment spreads. This issue affects deployments with enabled requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. A single unauthenticated request can block the Node.js event loop for [truncated]
CVE-2026-34532 is a critical vulnerability in Parse Server, an open-source backend that can be deployed to any infrastructure running Node.js. The vulnerability allows an attacker to bypass Cloud Function validator access controls by appending 'prototype.constructor' to the function name in the URL. This issue affects Parse Server versions prior to 8.6.67 and 9.7.0-alpha.11. The vulnerability has been pat [truncated]
