Facebook vulnerabilities

Products

• Hhvm 41
• Whatsapp For Android 26
• Whatsapp Business For Android 23
• Whatsapp For Ios 21
• Hermes 20
• Whatsapp Business For Ios 17
• Proxygen 13
• Thrift 11
• Thrift 11
• Hiphop Virtual Machine 7
• React 6
• Facebook 5
• Whatsapp Desktop 5
• Whatsapp Desktop For Mac 4
• Whatsapp Desktop For Windows 4
• Whatsapp For Windows Phone 4
• Zstandard 4
• For Woocommerce 3
• Fizz 3
• Folly 3
• Osquery 3
• For Woocommerce 2
• Instagram 2
• Mcrouter 2
• Mvfst 2
• Oculus Desktop 2
• Parlai 2
• Photouploader 2
• React-dev-utils 2
• Wangle 2
• Whatsapp Android 2
• Whatsapp Business For Iphone 2
• Whatsapp Iphone 2

Newest

• facebook proxygen In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams ... CVE-2026-91096 7.5 HighSeptember 28, 2026
• facebook proxygen In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction:... CVE-2026-91095 5.3 MediumSeptember 28, 2026
• facebook proxygen In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its... CVE-2026-84895 7.3 HighSeptember 28, 2026
• facebook for woocommerce WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-66707 7.1 HighAugust 6, 2026
• facebook for wordpress, unknown facebook for wordpress +1 more WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-66705 7.1 HighAugust 6, 2026
• facebook proxygen Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A... CVE-2026-44909 7.5 HighJuly 23, 2026
• facebook for woocommerce WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability CVE-2026-49059 4.7 MediumMay 27, 2026
• facebook whatsapp for android, whatsapp for ios, whatsapp +2 more Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25... CVE-2026-23866 4.3 MediumMay 1, 2026
• whatsapp, facebook whatsapp desktop for windows +1 more An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could... CVE-2026-23863 6.5 MediumMay 1, 2026
• facebook react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +2 more Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components CVE-2026-23870 Public exploitFix available 7.5 HighJanuary 28, 2026
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +3 more +5 more React Server Components have multiple Denial of Service Vulnerabilities CVE-2026-23864 Fix available 7.5 HighJanuary 26, 2026
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more Denial of Service Vulnerability in React Server Components CVE-2025-67779 Fix available EPSS 20.0% 7.5 HighDecember 11, 2025
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more Denial of Service Vulnerability in React Server Components CVE-2025-55184 Public exploitFix available EPSS 66.6% 7.5 HighDecember 11, 2025
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more Source Code Exposure Vulnerability in React Server Components CVE-2025-55183 Public exploitFix available EPSS 64.2% 5.3 MediumDecember 11, 2025
• facebook react, meta react server components, react-server-dom-parcel +3 more +5 more React Server Components are Vulnerable to RCE CVE-2025-55182 In KEVPublic exploitFix available EPSS 99.7% 10.0 CriticalDecember 3, 2025
• facebook proxygen Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in... CVE-2025-55181 5.3 MediumDecember 2, 2025
• facebook whatsapp business for ios, whatsapp for ios, whatsapp +2 more +4 more Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73,... CVE-2025-55179 5.4 MediumNovember 18, 2025
• facebook for woocommerce WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability CVE-2025-64296 5.3 MediumOctober 29, 2025
• facebook whatsapp business for ios, whatsapp for ios, meta platforms whatsapp +2 more +4 more Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to... CVE-2025-55177 In KEVPublic exploit EPSS 13.5% 5.4 MediumAugust 29, 2025
• facebook mvfst A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during... CVE-2025-30403 8.1 HighJuly 11, 2025
• whatsapp, facebook whatsapp desktop for windows +1 more A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments... CVE-2025-30401 EPSS 21.0% 6.7 MediumApril 5, 2025
• facebook below Below has Incorrect Permission Assignment for Critical Resource CVE-2025-27591 Public exploitFix available 6.8 MediumMarch 11, 2025
• facebook tacquito Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to… CVE-2024-49400 9.8 CriticalOctober 17, 2024
• facebook chat plugin – live chat plugin for wordpress Facebook Chat Plugin <= 1.5 - Missing Capabilities Check CVE-2020-36838 7.4 HighOctober 16, 2024
• facebook thrift A null-dereference vulnerability involving parsing requests specifying invalid protocols can... CVE-2024-45863 5.3 MediumSeptember 27, 2024
• facebook thrift A use-after-free vulnerability involving upgradeToRocket requests can cause the application to... CVE-2024-45773 Fix available 7.5 HighSeptember 27, 2024
• facebook github.com/huandu/facebook may expose access_token in error message CVE-2024-35232 Fix available 3.7 LowMay 24, 2024
• facebook meta spark studio, meta platforms, inc spark studio +1 more Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside... CVE-2024-23347 7.8 HighJanuary 16, 2024
• facebook katran Katran could disclose non-initialized kernel memory as part of an IP header. The issue was... CVE-2023-49062 7.5 HighNovember 28, 2023
• meta react developer tools extension, facebook react-devtools +1 more React Developer Tools extension Improper Authorization vulnerability CVE-2023-5654 Fix available 6.5 MediumOctober 19, 2023
• facebook tac plus, fedoraproject fedora +1 more A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent… CVE-2023-45239 Public exploit 9.8 CriticalOctober 6, 2023
• facebook whatsapp business for android, whatsapp business for ios, whatsapp desktop for mac +4 more +6 more A race condition in an event subsystem led to a heap use-after-free issue in established audio... CVE-2023-38538 5.0 MediumOctober 4, 2023
• facebook whatsapp business for android, whatsapp business for ios, whatsapp desktop for mac +4 more +6 more A race condition in a network transport subsystem led to a heap use-after-free issue in... CVE-2023-38537 5.6 MediumOctober 4, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• facebook hermes A use-after-free related to unsound inference in the bytecode generation when optimizations are... CVE-2023-30470 9.8 CriticalMay 18, 2023
• facebook netconsd netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A... CVE-2023-28753 Public exploit 9.8 CriticalMay 18, 2023
• facebook hermes A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81... CVE-2023-28081 9.8 CriticalMay 18, 2023
• facebook hermes A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could... CVE-2023-25933 9.8 CriticalMay 18, 2023
• facebook hermes A use-after-free in BigIntPrimitive addition in Hermes prior to commit... CVE-2023-24833 7.5 HighMay 18, 2023
• facebook hermes A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708... CVE-2023-24832 7.5 HighMay 18, 2023
• facebook fizz There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be... CVE-2023-23759 7.5 HighMay 18, 2023
• facebook hermes An error in Hermes' algorithm for copying objects properties prior to commit... CVE-2023-23557 9.8 CriticalMay 18, 2023
• facebook hermes An error in BigInt conversion to Number in Hermes prior to commit... CVE-2023-23556 9.8 CriticalMay 18, 2023
• facebook hhvm HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs... CVE-2022-36937 9.8 CriticalMay 10, 2023
• facebook lexical Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross... CVE-2023-30792 6.1 MediumApril 29, 2023
• microsoft zstd, facebook zstandard +1 more zstd vulnerable to buffer overrun CVE-2022-4899 Fix available 7.5 HighMarch 29, 2023
• facebook redex DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of... CVE-2022-36938 9.8 CriticalNovember 10, 2022
• facebook hermes An integer conversion error in Hermes bytecode generation, prior to commit... CVE-2022-40138 9.8 CriticalOctober 11, 2022
• facebook hermes A write-what-where condition in hermes caused by an integer overflow, prior to commit... CVE-2022-35289 9.8 CriticalOctober 11, 2022
• facebook hermes An out of bounds write in hermes, while handling large arrays, prior to commit... CVE-2022-32234 9.8 CriticalOctober 11, 2022
• Show olderLoading…