Cpe:2.3:a:parseplatform:parse-Server:*:*:*:*:*:*:*:*

Parse Server versions before 8.6.115 and 9.x before 9.10.7-alpha.1 contain a regular expression denial of service (ReDoS) vulnerability that allows unauthenticated or authenticated attackers to exhaust the Node.js event loop via crafted email addresses.

A vulnerability in Parse Server's device token deduplication logic allows unauthenticated remote attackers to inject NoSQL query operators, leading to unauthorized deletion of device registrations.