Facebook - vulnerabilities (CVEs)

188 CVEs in 82 products, 3 in the last 30 days, newest from 2026-09-28.

Products

Hhvm - 40 CVEs
Whatsapp For Android - 23 CVEs
Hermes - 20 CVEs
Whatsapp Business For Android - 20 CVEs
Whatsapp For Ios - 19 CVEs
Whatsapp Business For Ios - 15 CVEs
Proxygen - 12 CVEs
Facebook Thrift - 11 CVEs
Thrift - 11 CVEs
Hiphop Virtual Machine - 7 CVEs
React - 6 CVEs
Facebook - 5 CVEs
Whatsapp Desktop - 5 CVEs
Whatsapp Desktop For Mac - 4 CVEs
Whatsapp Desktop For Windows - 4 CVEs
Whatsapp For Windows Phone - 4 CVEs
Zstandard - 4 CVEs
Facebook For Woocommerce - 3 CVEs
Fizz - 3 CVEs
Folly - 3 CVEs
Osquery - 3 CVEs
Instagram - 2 CVEs
Mcrouter - 2 CVEs
Mvfst - 2 CVEs
Oculus Desktop - 2 CVEs
Parlai - 2 CVEs
Photouploader - 2 CVEs
React-dev-utils - 2 CVEs
Wangle - 2 CVEs
Whatsapp Android - 2 CVEs
Whatsapp Business For Iphone - 2 CVEs
Whatsapp Iphone - 2 CVEs
Below - 1 CVEs
Buck - 1 CVEs
Facebook Chat Plugin Live Chat Plugin For Wordpress - 1 CVEs
Facebook For Wordpress - 1 CVEs
Facebook Gameroom - 1 CVEs
Facebook Messenger - 1 CVEs
Gameroom - 1 CVEs
Instagram For Android - 1 CVEs
Katran - 1 CVEs
Lexical - 1 CVEs
Messenger - 1 CVEs
Meta Spark Studio - 1 CVEs
Netconsd - 1 CVEs
Nuclide - 1 CVEs
React-devtools - 1 CVEs
React-dom - 1 CVEs
React-native - 1 CVEs
React-server-dom-parcel - 1 CVEs
React-server-dom-turbopack - 1 CVEs
React-server-dom-webpack - 1 CVEs
Redex - 1 CVEs
Tac Plus - 1 CVEs
Tacquito - 1 CVEs
Whatsapp Enterprise Client - 1 CVEs
Whatsapp For Kaios - 1 CVEs
Whatsapp For Portal - 1 CVEs
Whatsapp For Tizen - 1 CVEs
Al Jazeera - 0 CVEs
Arabic Troll Football - 0 CVEs
Barcode Scanner - 0 CVEs
Best Beginning - 0 CVEs
Bilingual Magic Ball - 0 CVEs
Bilingual Magic Ball Relajo - 0 CVEs
Bite It! - 0 CVEs
Create-react-app - 0 CVEs
Face Fun Photo Collage Maker 2 - 0 CVEs
Facebook Platform - 0 CVEs
Fire Equipments Screen Lock - 0 CVEs
Hunting Trophy Whitetails - 0 CVEs
Instaroid - Instagram Viewer - 0 CVEs
Kazakhstan Radio - 0 CVEs
Logosquest - Beginnings - 0 CVEs
Macedonia Hacienda Hotel - 0 CVEs
News Revolution - Bahrain - 0 CVEs
Pakan Ken Tube - 0 CVEs
Radio De La Cato - 0 CVEs
Savage Nation Mobile Web - 0 CVEs
Street Walker - 0 CVEs
Suriname Radio - 0 CVEs
Zhang Zhijun Taiwan Visit 2014-06-25 - 0 CVEs

Newest CVEs of Facebook

CVE-2026-91096 - CVSS 7.5 (high), 2026-09-28: In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…
CVE-2026-91095 - CVSS 5.3 (medium), 2026-09-28: In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…
CVE-2026-84895 - CVSS 7.3 (high), 2026-09-28: In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…
CVE-2026-66707 - CVSS 7.1 (high), 2026-08-06: Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
CVE-2026-66705 - CVSS 7.1 (high), 2026-08-06: Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
CVE-2026-44909 - CVSS 7.5 (high), 2026-07-23: Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…
CVE-2026-49059 - CVSS 4.7 (medium), 2026-05-27: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for…
CVE-2026-23870 - CVSS 7.5 (high), 2026-05-06: A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server…
CVE-2026-23866 - CVSS 4.3 (medium), 2026-05-01: Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to…
CVE-2026-23863 - CVSS 6.5 (medium), 2026-05-01: An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL…
CVE-2026-23864 - CVSS 7.5 (high), 2026-01-26: Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel,…
CVE-2025-67779 - CVSS 7.5 (high), 2025-12-12: It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific…
CVE-2025-55183 - CVSS 5.3 (medium), 2025-12-11: An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and…
CVE-2025-55184 - CVSS 7.5 (high), 2025-12-11: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1,…
CVE-2025-55182 - CVSS 10 (critical), 2025-12-03: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…
CVE-2025-55181 - CVSS 5.3 (medium), 2025-12-02: Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…
CVE-2025-55179 - CVSS 5.4 (medium), 2025-11-18: Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac…
CVE-2025-64296 - CVSS 5.3 (medium), 2025-10-29: Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control…
CVE-2025-55177 - CVSS 5.4 (medium), 2025-08-29: Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…
CVE-2025-30403 - CVSS 8.1 (high), 2025-07-11: A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to…
CVE-2025-30401 - CVSS 6.7 (medium), 2025-04-05: A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler…
CVE-2025-27591 - CVSS 6.8 (medium), 2025-03-11: A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This…
CVE-2024-49400 - CVSS 9.8 (critical), 2024-10-17: Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured…
CVE-2020-36838 - CVSS 7.4 (high), 2024-10-16: The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in…
CVE-2024-45863 - CVSS 5.3 (medium), 2024-09-27: A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other…
CVE-2024-45773 - CVSS 7.5 (high), 2024-09-27: A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other…
CVE-2024-35232 - CVSS 3.7 (low), 2024-05-24: github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be…
CVE-2024-23347 - CVSS 7.8 (high), 2024-01-16: Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project.…
CVE-2023-49062 - CVSS 7.5 (high), 2023-11-28: Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet…
CVE-2023-5654 - CVSS 6.5 (medium), 2023-10-19: The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to…