CVE-2026-119126
Low · 3.1CVSS
3.1
EPSS
0.3%
Published
Oct 29, 2026
CISA due date
—
The record
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62334 OpenVM is a performant and modular zkVM framework built for customization and… CWE-754
- CVE-2026-107311 Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions… CWE-754
- CVE-2026-62374 SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT)… CWE-754
- CVE-2026-86412 A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie… CWE-754
- CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. CWE-754
- CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep… CWE-754
- CVE-2026-98148 In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate… CWE-754
- CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-754