https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T18:48:42.430574+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-32886 CVE-2026-32886 — Parse Server's Cloud function dispatch crashes server via prototype chain traversal 2026-10-15T18:48:42.446491+00:00

Affected: parse-community parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.