CVE-2026-119126

3.1 LOWpublic exploit available

Published 2026-10-29 · Updated 2026-10-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-754

Public exploit & PoC references

https://github.com/parse-community/parse-server/security/advisories/GHSA-969q-274f-mc7w

All references

https://github.com/parse-community/parse-server/security/advisories/GHSA-969q-274f-mc7w
https://www.vulncheck.com/advisories/parse-server-before-8.6.106-and-9.0.0-before-9.10.5-alpha.7-aftersave-trigger-and-livequery-bypass-via-dot-notation-keys

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-0317
UNSCOREDCVE-2026-0318
UNSCOREDCVE-2026-0319
UNSCOREDCVE-2026-0321
HIGHCVE-2026-100296
HIGHCVE-2026-100352PoC
HIGHCVE-2026-102077
MEDIUMCVE-2026-104432PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.