CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109954
MEDIUMCVSS 6.5NVD feed
Published 13 October 2026 · tracked since 14 October 2026
Description
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' ack
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-65197 LOW 3.1
- CVE-2026-53418 HIGH 8.1
- CVE-2026-109521 HIGH 7.3
- CVE-2026-109522 HIGH 7.3
- CVE-2026-109523 HIGH 7.3
- CVE-2026-108184 HIGH 7.4
- CVE-2026-106108
- CVE-2026-107460
- CVE-2026-102342 MEDIUM 5.4
- CVE-2026-74036 HIGH 7.2