WH
Product
Whatsapp
On CISA KEVExploited in the wild
44
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 13Medium 15Low 1
Watch
Add Whatsapp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-55177 In wildKEV | 5.4 | Aug 29 | Meta Platforms WhatsApp Incorrect Authorization Vulnerability Affected: 2.22.25.2 before 2.25.21.73; 2.22.25.2 before 2.25.21.78 |
| CVE-2025-30401 | 6.7 | Apr 5 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the… Affected: before 2.2450.6 |
| CVE-2026-23863 | 6.5 | May 1 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename… Affected: before 2.3000.1032164386.258709 |
| CVE-2020-20096 | 6.5 | Mar 23 | Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially… Affected: through 2.19.80; through 2.19.222 |
| CVE-2019-3566 | 5.9 | May 10 | A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent… Affected: 2.19.54 through 2.19.103; 2.19.52 |
| CVE-2023-38537 | 5.6 | Oct 4 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app… Affected: before 2.2338.12 |
| CVE-2020-1904 | 5.5 | Oct 6 | A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when… Affected: before 2.20.61 |
| CVE-2020-1903 | 5.5 | Oct 6 | An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an… Affected: before 2.20.61 |
| CVE-2025-55179 | 5.4 | Nov 18 | Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have… Affected: 2.25.8.14 before 2.25.23.83; 2.25.8.17 before 2.25.23.73 |
| CVE-2020-1901 | 5.3 | Oct 6 | Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message Affected: before 2.20.91.4 |
| CVE-2019-3571 | 5.3 | Jul 16 | An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension Affected: before 0.3.3793; before 0.3.3793 |
| CVE-2023-38538 | 5.0 | Oct 4 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow… Affected: before 2.2320.2 |
| CVE-2020-1908 | 4.6 | Nov 3 | Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp… Affected: before 2.20.100 |
| CVE-2017-8769 | 4.6 | May 18 | Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) associated with a chat,… Affected: before 2.16.323 |
| CVE-2026-23866 | 4.3 | May 1 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have… Affected: 2.25.8.0 through 2.26.7.10; 2.25.8.0 through 2.26.15.72 |
Showing 15