CVE-2026-116161

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.

• CWE-200

• https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp
• https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.4-livequery-information-disclosure-via-or-subscriptions

Published

Oct 25, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116156ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contain…3.3
• CVE-2026-116157ImageMagick before 7.1.2-33 contains a memory leak vulnerabi…3.3
• CVE-2026-116158ImageMagick before 7.1.2-33 contains a memory leak vulnerabi…2.5
• CVE-2026-116159ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contain…3.3
• CVE-2026-11616The Events Calendar for GeoDirectory plugin for WordPress is…8.8
• CVE-2026-116160ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contain…3.3
• CVE-2026-116162Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 …2.1
• CVE-2026-116163Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 …7.4
• CVE-2026-116164Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 …6.3
• CVE-2026-116165Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 …8.8
• CVE-2026-116166SiYuan 3.6.0 before 3.8.7 accepts and persists the networkSe…6.8
• CVE-2026-116167SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripti…6.8