Loading story…
Parse Server disclosed two high-severity vulnerabilities affecting different attack paths in deployments running versions prior to recent fixes. CVE-2026-33539 is a CWE-89 SQL injection flaw in Parse Server environments that use the PostgreSQL adapter, where an attacker with master key access can inject SQL metacharacters through field-name parameters in the aggregate $group stage or the distinct operation. The issue can let a Parse Server application administrator escalate privileges to direct PostgreSQL database-level access. MongoDB-backed deployments are not affected, and fixes are available in versions 8.6.59 and 9.6.0-alpha.53.
A separate issue, CVE-2026-33538, allows an unauthenticated denial-of-service attack against Parse Server by sending authentication requests with arbitrary, unconfigured provider names. In affected versions before 8.6.58 and 9.6.0-alpha.52, those requests trigger unindexed database queries that can force full collection scans on the user database; when parallelized, the traffic can exhaust database resources and degrade service availability. The flaw is classified as CWE-400, and both vulnerabilities were published through GitHub security advisories with patched releases available.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A denial-of-service vulnerability in Parse Server's GraphQL query complexity validator was publicly disclosed, affecting deployments before versions 8.6.68 and 9.7.0-alpha.12 that enabled certain requestComplexity options. The flaw allows an unauthenticated attacker to send crafted GraphQL fragment spreads that block the Node.js event loop, and fixes were released in the patched versions.
A SQL injection vulnerability affecting Parse Server deployments using PostgreSQL before versions 8.6.59 and 9.6.0-alpha.53 was publicly disclosed through a GitHub security advisory. The issue allows an attacker with master key access to inject SQL metacharacters in aggregate or distinct field names and potentially escalate to PostgreSQL database-level access; patched versions were released.
A denial-of-service vulnerability affecting Parse Server deployments before versions 8.6.58 and 9.6.0-alpha.52 was publicly disclosed. The flaw lets unauthenticated attackers trigger expensive unindexed database queries via arbitrary unconfigured auth provider names, and fixes were made available in the patched releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Parse Server disclosed and patched **CVE-2026-57480**, a denial-of-service flaw caused by exponential-time processing of deeply nested query operators in REST API and LiveQuery handling. An attacker can send crafted queries using logical operators such as `$or`, `$and`, and `$nor` to trigger excessive processing, block the Node.js event loop, and degrade availability. The issue affects versions earlier than `8.6.82` and `9.0.0-alpha.1` through before `9.9.1-alpha.12`, and is tracked in GitHub advisories as `GHSA-cgxm-vr2f-6fj8`. Parse Server maintainers fixed the bug by updating query validation and traversal logic so nested logical operators are detected even when buried under field-level operators such as `$elemMatch` and `$not` or under plain field names. The patches also enforce query-depth limits more consistently, reject malformed logical operators whose values are not arrays, and prevent repeated traversal patterns that could lead to `O(2^n)` behavior. The fixes were merged through pull request `#10512`, with releases available in **8.6.82** and **9.9.1-alpha.12**, alongside tests confirming maliciously nested queries are rejected or handled in linear time rather than hanging the server.
Jul 9, 2026
PostgreSQL has released security updates for all supported branches after fixing **28 vulnerabilities**, including several high-severity flaws that could lead to remote code execution or full compromise of database instances. Patched versions are **14.24**, **15.19**, **16.15**, **17.11**, and **18.6**. Among the most serious issues are **`CVE-2026-14662`**, an out-of-bounds write involving the `tsvector` and `tsquery` data types, and **`CVE-2026-18408`**, which can enable code execution during the database restore process. Additional high-impact bugs disclosed in the same release include **`CVE-2026-14669`**, a heap buffer overflow in `to_char(timestamptz)` triggered by long POSIX timezone abbreviations and rated **CVSS 8.8**, and **`CVE-2026-14679`**, an argument-matching flaw that permits controlled out-of-bounds writes on the stack and carries a **CVSS 8.2** score. Successful exploitation of these vulnerabilities could allow attackers to execute code as the operating-system user running PostgreSQL. PostgreSQL said it had no reports of active exploitation at publication time and also warned that support for **PostgreSQL 14** ends on **November 12, 2026**, after which it will no longer receive security fixes.
Aug 20, 2026
Microsoft disclosed two high-severity database-related vulnerabilities affecting **PgBouncer** and **PostgreSQL**, including `CVE-2026-6665`, a stack-based buffer overflow in PgBouncer's **SCRAM** authentication handling, and `CVE-2026-6637`, which affects PostgreSQL's `refint` component and can allow both a stack buffer overflow and **SQL injection**. The PgBouncer issue is classified as `CWE-121` and carries a **CVSS 8.1** score, indicating high potential impact to confidentiality, integrity, and availability. According to Microsoft's advisory, `CVE-2026-6665` is remotely reachable over the network, requires **no privileges** and **no user interaction**, though exploitation is assessed as having **high attack complexity**. The related PostgreSQL `refint` flaw broadens the risk profile by combining memory corruption with SQL injection exposure, raising concern for organizations running PostgreSQL environments directly or behind PgBouncer connection pooling layers.
Jun 29, 2026