Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,899All CVEsplus 19,118 rejected
- 379Last 24 hours2,801 in the last 7 days
- 16,786Last 30 days1,548 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 14 | 43 | 44 | 17 | 0 | 118 | 155 |
| 2025 | 0 | 2 | 6 | 0 | 0 | 8 | 37 |
| 2024 | 3 | 1 | 0 | 0 | 0 | 4 | 29 |
| 2023 | 1 | 3 | 2 | 0 | 0 | 6 | 25 |
| 2022 | 2 | 8 | 1 | 1 | 0 | 12 | 19 |
| 2021 | 0 | 2 | 1 | 0 | 0 | 3 | 7 |
| 2020 | 0 | 2 | 2 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-122301 | Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Responseparse-community · parse-server | Low2.3 |
| CVE-2026-121965 | Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Keyparse-community · parse-server | Medium6.0 |
| CVE-2026-121415 | Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Keyparse-community · parse-server | Medium6.3 |
| CVE-2026-121414 | Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Updateparse-community · parse-server | High8.2 |
| CVE-2026-121413 | Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSessionparse-community · parse-server | Low2.3 |
| CVE-2026-120310 | Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Responseparse-community · parse-server | Low2.3 |
| CVE-2026-119571 | Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation IDparse-community · parse-server | Medium6.3 |
| CVE-2026-119570 | Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responsesparse-community · parse-server | Low2.3 |
| CVE-2026-119569 | Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Serviceparse-community · parse-server | Medium6.0 |
| CVE-2026-119126 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keysparse-community · parse-server | Low2.3 |
| CVE-2026-119125 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fieldsparse-community · parse-server | Low2.3 |
| CVE-2026-116801 | Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Queryparse-community · parse-server | Medium5.3 |
| CVE-2026-116165 | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDBparse-community · parse-server | High8.8 |
| CVE-2026-116164 | Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writesparse-community · parse-server | Medium6.3 |
| CVE-2026-116163 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclassesparse-community · parse-server | Critical9.1 |
| CVE-2026-116162 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Loginparse-community · parse-server | Low2.1 |
| CVE-2026-116161 | Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptionsparse-community · parse-server | Medium6.0 |
| CVE-2026-112769 | Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypassparse-community · parse-server | Low2.3 |
| CVE-2026-112768 | Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Updateparse-community · parse-server | Medium6.9 |
| CVE-2026-110854 | Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Errorparse-community · parse-server | High8.2 |
| CVE-2026-109954 | Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interferenceparse-community · parse-server | High8.3 |
| CVE-2026-109303 | Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Queryparse-community · parse-server | Medium5.3 |
| CVE-2026-109302 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queriesparse-community · parse-server | Medium6.3 |
| CVE-2026-109301 | Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URLparse-community · parse-server | High8.2 |
| CVE-2026-105828 | Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errorsparse-community · parse-server | Medium6.3 |
| CVE-2026-101042 | Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identityparse-community · parse-server | High7.4 |
| CVE-2026-100632 | Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQueryparse-community · parse-server | High7.1 |
| CVE-2026-100631 | Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injectionparse-community · parse-server | High8.7 |
| CVE-2026-87806 | Parse Server 9.0.0 Authentication Bypass via LDAP Empty Passwordparse-community · parse-server | Critical9.1 |
| CVE-2026-66009 | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messagesparse-community · parse-server | Medium6.3 |
| CVE-2026-66008 | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messagesparse-community · parse-server | Medium6.3 |
| CVE-2026-64627 | Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercionparse-community · parse-server | Medium6.9 |
| CVE-2026-61448 | Parse Server 9.0.0 Stored XSS via malformed Content-Typeparse-community · parse-server | Low2.1 |
| CVE-2026-57481 | Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access changeparse-community · parse-server | Low2.3 |
| CVE-2026-57480 | Parse Server: Denial of service via exponential-time processing of deeply nested query operatorsparse-community · parse-server | High8.7 |
| CVE-2026-55778 | Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklistparse-community · parse-server | Low2.1 |
| CVE-2021-47987 | Parse Server - Arbitrary Code Execution via Malicious Version Tagsparse-community · parse-server | High7.7 |
| CVE-2021-47986 | Parse Server - Unreviewed Code Execution via Malicious Version Tagsparse-community · parse-server | High7.7 |
| CVE-2026-53726 | Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLparse-community · parse-server | Medium6.9 |
| CVE-2026-53725 | Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is deniedparse-community · parse-server | Medium5.9 |
| CVE-2026-53724 | Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistparse-community · parse-server | Low2.1 |
| CVE-2026-50008 | Parse Server: Server option routeAllowList is bypassable through batch sub-requestsparse-community · parse-server | Medium6.9 |
| CVE-2026-47138 | Parse Server: Pre-authentication denial of service via client version header regex backtrackingparse-community · parse-server | High8.7 |
| CVE-2026-47248 | Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersparse-community · parse-server | Medium6.9 |
| CVE-2026-43930 | Parse Server: MFA SMS one-time password accepted twice under concurrent loginparse-community · parse-server | Low2.1 |
| CVE-2026-39381 | Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`parse-community · parse-server | Medium5.3 |
| CVE-2026-39321 | Parse Server has a login timing side-channel reveals user existenceparse-community · parse-server | Medium6.3 |
| CVE-2026-35200 | Parse Server has a file upload Content-Type override via extension mismatchparse-community · parse-server | Low2.1 |
| CVE-2026-34784 | Parse Server: Streaming file download bypasses afterFind file trigger authorizationparse-community · parse-server | High8.2 |
| CVE-2026-34215 | Parse Server: Auth data exposed via verify password endpointparse-community · parse-server | High8.2 |