https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T22:59:24.835765+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33539 CVE-2026-33539 — Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter 2026-10-17T22:59:24.852917+00:00

Affected: parse-community parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.