https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T09:52:57.239731+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-60688 EUVD-2026-60688 2026-10-04T09:52:57.312460+00:00 EUVD-2026-60688 https://cve.radiocsirt.org/vuln/fkie_cve-2019-1020013 fkie_cve-2019-1020013 2026-10-04T09:52:57.312498+00:00

parse-server before 3.6.0 allows account enumeration.

 https://cve.radiocsirt.org/vuln/ghsa-8w3j-g983-8jh5 GHSA-8w3j-g983-8jh5 — Sensitive Data Exposure in parse-server 2026-10-04T09:52:57.312530+00:00

Affected: npm: parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. `ParseError.ACCOUNT_ALREADY_LINKED(208)` was thrown BEFORE the AuthController checks the password and throws a `ParseError.SESSION_MISSING(206)` for Insufficient auth. An attacker can guess ids and get information about linked accounts/email addresses.

### For more information If you have any questions or comments about this advisory, Open an issue in the [parse-server](https://github.com/parse-community/parse-server) [Parse Community Vulnerability Disclosure Program](https://github.com/parse-community/parse-server/blob/master/SECURITY.md)

 https://cve.radiocsirt.org/vuln/gsd-2019-1020013 gsd-2019-1020013 2026-10-04T09:52:57.312558+00:00 gsd-2019-1020013