FA
Vendor
Facebook
155
CVEs
12
On KEV
3
New 30D
Products
PR9.8
proxygen
Facebook
11 CVEs1 on KEV3 new
WF9.8
WhatsApp for iOS
Facebook
3 CVEs2 on KEV0 new
WB9.8
WhatsApp Business for iOS
Facebook
2 CVEs2 on KEV0 new
RE10.0
React
Facebook
6 CVEs1 on KEV0 new
WF9.8
WhatsApp for Android
Facebook
2 CVEs1 on KEV0 new
WB9.8
WhatsApp Business for Android
Facebook
1 CVEs1 on KEV0 new
WD8.2
WhatsApp Desktop
Facebook
1 CVEs1 on KEV0 new
WD5.4
WhatsApp Desktop for Mac
Facebook
1 CVEs1 on KEV0 new
WF9.8
WhatsApp for Tizen
Facebook
1 CVEs1 on KEV0 new
WF9.8
WhatsApp for Windows Phone
Facebook
1 CVEs1 on KEV0 new
HH9.8
HHVM
Facebook
40 CVEs0 on KEV0 new
HE9.8
Hermes
Facebook
20 CVEs0 on KEV0 new
TH9.8
Thrift
Facebook
9 CVEs0 on KEV0 new
HV9.8
Hiphop Virtual Machine
Facebook
7 CVEs0 on KEV0 new
FA8.8
Facebook
Facebook
4 CVEs0 on KEV0 new
FF8.8
Facebook for WooCommerce
Facebook
4 CVEs0 on KEV0 new
ZS8.1
Zstandard
Facebook
4 CVEs0 on KEV0 new
FI7.5
Fizz
Facebook
3 CVEs0 on KEV0 new
FO9.8
Folly
Facebook
3 CVEs0 on KEV0 new
IN7.8
Instagram
Facebook
2 CVEs0 on KEV0 new
MC7.5
Mcrouter
Facebook
2 CVEs0 on KEV0 new
PA9.8
Parlai
Facebook
2 CVEs0 on KEV0 new
PH–
Photouploader
Facebook
2 CVEs0 on KEV0 new
RE9.8
React-dev-utils
Facebook
2 CVEs0 on KEV0 new
WA9.8
Wangle
Facebook
2 CVEs0 on KEV0 new
BE6.8
Below
Facebook
1 CVEs0 on KEV0 new
BU9.8
Buck
Facebook
1 CVEs0 on KEV0 new
FF7.1
Facebook for WordPress
Facebook
1 CVEs0 on KEV0 new
FM–
Facebook Messenger
Facebook
1 CVEs0 on KEV0 new
GA9.8
Gameroom
Facebook
1 CVEs0 on KEV0 new
KA7.5
Katran
Facebook
1 CVEs0 on KEV0 new
LE6.1
Lexical
Facebook
1 CVEs0 on KEV0 new
ME6.5
Messenger
Facebook
1 CVEs0 on KEV0 new
MS7.8
Meta Spark Studio
Facebook
1 CVEs0 on KEV0 new
MV7.5
Mvfst
Facebook
1 CVEs0 on KEV0 new
NE9.8
Netconsd
Facebook
1 CVEs0 on KEV0 new
NU9.8
Nuclide
Facebook
1 CVEs0 on KEV0 new
RE6.5
React-devtools
Facebook
1 CVEs0 on KEV0 new
RE7.5
React-native
Facebook
1 CVEs0 on KEV0 new
RE7.5
React-server-dom-parcel
Facebook
1 CVEs0 on KEV0 new
RE7.5
React-server-dom-turbopack
Facebook
1 CVEs0 on KEV0 new
RE7.5
React-server-dom-webpack
Facebook
1 CVEs0 on KEV0 new
RE9.8
Redex
Facebook
1 CVEs0 on KEV0 new
TP9.8
Tac Plus
Facebook
1 CVEs0 on KEV0 new
WD6.5
WhatsApp Desktop for Windows
Facebook
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-91096 | PR proxygen Facebook | 7.5 | Sep 28 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister… |
| CVE-2026-91095 | PR proxygen Facebook | 5.3 | Sep 28 | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles… |
| CVE-2026-84895 | PR proxygen Facebook | 7.3 | Sep 28 | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method |
| CVE-2026-66707 | FF Facebook for WooCommerce Facebook | 7.1 | Aug 6 | WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-66705 | FF Facebook for WordPress Facebook | 7.1 | Aug 6 | WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-44909 | PR proxygen Facebook | 7.5 | Jul 23 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer |
| CVE-2026-49059 | FF Facebook for WooCommerce Facebook | 4.7 | May 27 | WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability |
| CVE-2026-23870 | RE React-server-dom-turbopack Facebook | 7.5 | May 6 | A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory… |
| CVE-2026-23866 | WF WhatsApp for iOS Facebook | 4.3 | May 1 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have… |
| CVE-2026-23863 | WD WhatsApp Desktop for Windows Facebook | 6.5 | May 1 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename… |
| CVE-2026-23864 | RE React Facebook | 7.5 | Jan 26 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack,… |
| CVE-2025-67779 | RE React Facebook | 7.5 | Dec 12 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case |
| CVE-2025-55184 | RE React Facebook | 7.5 | Dec 11 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following… |
| CVE-2025-55183 | RE React Facebook | 5.3 | Dec 11 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the… |
| CVE-2025-55182 RansomwareIn wildKEV | RE React Facebook | 10.0 | Dec 3 | Meta React Server Components Remote Code Execution Vulnerability |
| CVE-2025-55181 | PR Proxygen Facebook | 5.3 | Dec 2 | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and… |
| CVE-2025-55177 In wildKEV | WD WhatsApp Desktop for Mac Facebook | 5.4 | Aug 29 | Meta Platforms WhatsApp Incorrect Authorization Vulnerability |
| CVE-2025-27591 | BE Below Facebook | 6.8 | Mar 11 | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below |
| CVE-2024-23347 | MS Meta Spark Studio Facebook | 7.8 | Jan 16 | Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project |
| CVE-2023-49062 | KA Katran Facebook | 7.5 | Nov 28 | Katran could disclose non-initialized kernel memory as part of an IP header |
| CVE-2023-5654 | RE React-devtools Facebook | 6.5 | Oct 19 | The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is… |
| CVE-2023-44487 In wildKEV | PR Proxygen Facebook | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability |
| CVE-2023-45239 | TP Tac Plus Facebook | 9.8 | Oct 6 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr,… |
| CVE-2023-30470 | HE Hermes Facebook | 9.8 | May 18 | A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could… |
| CVE-2023-28753 | NE Netconsd Facebook | 9.8 | May 18 | netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function |
| CVE-2023-28081 | HE Hermes Facebook | 9.8 | May 18 | A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a… |
| CVE-2023-25933 | HE Hermes Facebook | 9.8 | May 18 | A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted… |
| CVE-2023-24833 | HE Hermes Facebook | 7.5 | May 18 | A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes… |
| CVE-2023-24832 | HE Hermes Facebook | 7.5 | May 18 | A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the… |
| CVE-2023-23759 | FI Fizz Facebook | 7.5 | May 18 | There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely |
| CVE-2023-23557 | HE Hermes Facebook | 9.8 | May 18 | An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary… |
| CVE-2023-23556 | HE Hermes Facebook | 9.8 | May 18 | An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code… |
| CVE-2022-36937 | HH Hhvm Facebook | 9.8 | May 10 | HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension |
| CVE-2023-30792 | LE Lexical Facebook | 6.1 | Apr 29 | Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted… |
| CVE-2022-4899 | ZS Zstandard Facebook | 7.5 | Mar 31 | A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun |
| CVE-2022-36938 | RE Redex Facebook | 9.8 | Nov 11 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code… |
| CVE-2022-40138 | HE Hermes Facebook | 9.8 | Oct 11 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and… |
| CVE-2022-35289 | HE Hermes Facebook | 9.8 | Oct 11 | A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary… |
| CVE-2022-32234 | HE Hermes Facebook | 9.8 | Oct 11 | An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via… |
| CVE-2022-27810 | HE Hermes Facebook | 7.5 | Oct 6 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript |
| CVE-2020-20094 | IN Instagram Facebook | 6.5 | Mar 23 | Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially… |
| CVE-2020-20093 | ME Messenger Facebook | 6.5 | Mar 23 | The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI… |
| CVE-2021-24044 | HE Hermes Facebook | 9.8 | Jan 15 | By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error… |
| CVE-2021-24045 | HE Hermes Facebook | 9.8 | Dec 13 | A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0 |
| CVE-2019-3556 | HH Hhvm Facebook | 8.1 | Oct 26 | HHVM supports the use of an "admin" server which accepts administrative requests over HTTP |
| CVE-2021-39207 | PA Parlai Facebook | 8.8 | Sep 10 | parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets |
| CVE-2021-24040 | PA Parlai Facebook | 9.8 | Sep 10 | Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code… |
| CVE-2021-24036 | HH Hhvm Facebook | 9.8 | Jul 23 | Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code… |
| CVE-2021-24037 | HE Hermes Facebook | 9.8 | Jun 15 | A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code… |
| CVE-2020-1920 | RE React-native Facebook | 7.5 | Jun 1 | A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash |
| CVE-2021-24028 | TH Thrift Facebook | 9.8 | Apr 14 | An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects |
| CVE-2021-24218 | FA Facebook Facebook | 8.8 | Apr 12 | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce… |
| CVE-2021-24217 | FA Facebook Facebook | 8.1 | Apr 12 | The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object… |
| CVE-2021-24029 | PR Proxygen Facebook | 7.5 | Mar 15 | A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion |
| CVE-2020-1900 | HH Hhvm Facebook | 9.8 | Mar 11 | When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it |
| CVE-2020-1899 | HH Hhvm Facebook | 7.5 | Mar 11 | The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization |
| CVE-2020-1898 | HH Hhvm Facebook | 7.5 | Mar 11 | The fb_unserialize function did not impose a depth limit for nested deserialization |
| CVE-2021-24030 | GA Gameroom Facebook | 9.8 | Mar 10 | The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable |
| CVE-2021-24025 | HH Hhvm Facebook | 9.8 | Mar 10 | Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow |
| CVE-2020-1921 | HH Hhvm Facebook | 7.5 | Mar 10 | In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer |