CVE-2026-121415
Low · 3.7CVSS
3.7
EPSS
0.4%
Published
Nov 3, 2026
CISA due date
—
The record
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116654 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
- CVE-2026-116653 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
- CVE-2026-121240 Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121242 Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed… CWE-20
- CVE-2026-121236 Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121163 Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121115 Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20