Veille CVE

Semaine du 12 octobre au 18 octobre 2026

5 CVE

Critique 0 Élevée 1 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « parse-community parse-server » ✕
  1. CVE-2026-110854 8.2 Élevée

    parse-community parse-server

    Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.

  2. CVE-2026-109954 6.5 Moyenne

    parse-community parse-server

    Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

  3. CVE-2026-109303 4.3 Moyenne

    parse-community parse-server

    Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can combine counts with an objectId constraint as a membership oracle to reveal confidential memberships such as private groups or block lists.

  4. CVE-2026-109302 3.7 Faible

    parse-community parse-server

    Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.

  5. CVE-2026-109301 5.9 Moyenne

    parse-community parse-server

    Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.