Facebook vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-91096	PR proxygen Facebook	7.5	0%	Sep 28	In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister…
CVE-2026-91095	PR proxygen Facebook	5.3	0%	Sep 28	In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles…
CVE-2026-84895	PR proxygen Facebook	7.3	0%	Sep 28	In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method
CVE-2026-66707	FF Facebook for WooCommerce Facebook	7.1	0%	Aug 6	WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
CVE-2026-66705	FF Facebook for WordPress Facebook	7.1	0%	Aug 6	WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-44909	PR proxygen Facebook	7.5	1%	Jul 23	Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer
CVE-2026-49059	FF Facebook for WooCommerce Facebook	4.7	0%	May 27	WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability
CVE-2026-23870	RE React-server-dom-parcel Facebook	7.5	2%	May 6	A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory…
CVE-2026-23866	WF WhatsApp for iOS Facebook	4.3	0%	May 1	Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have…
CVE-2026-23863	WD WhatsApp Desktop for Windows Facebook	6.5	1%	May 1	An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename…
CVE-2026-23864	RE React Facebook	7.5	3%	Jan 26	Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack,…
CVE-2025-67779	RE React Facebook	7.5	20%	Dec 11	It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case
CVE-2025-55184	RE React Facebook	7.5	67%	Dec 11	A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following…
CVE-2025-55183	RE React Facebook	5.3	64%	Dec 11	An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the…
CVE-2025-55182 RansomwareIn wildKEV	RE React Facebook	10.0	100%	Dec 3	Meta React Server Components Remote Code Execution Vulnerability
CVE-2025-55181	PR proxygen Facebook	5.3	0%	Dec 2	Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and…
CVE-2025-55179	WF WhatsApp for iOS Facebook	5.4	0%	Nov 18	Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have…
CVE-2025-64296	FF Facebook for WooCommerce Facebook	5.3	0%	Oct 29	WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability
CVE-2025-55177 In wildKEV	WD WhatsApp Desktop for Mac Facebook	5.4	13%	Aug 29	Meta Platforms WhatsApp Incorrect Authorization Vulnerability
CVE-2025-30403	MV mvfst Facebook	8.1	0%	Jul 11	A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session
CVE-2025-30401	WD WhatsApp Desktop for Windows Facebook	6.7	21%	Apr 5	A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the…
CVE-2025-27591	BE Below Facebook	6.8	0%	Mar 11	A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below
CVE-2024-49400	TA Tacquito Facebook	9.8	0%	Oct 17	Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments
CVE-2020-36838	FC Facebook Chat Plugin – Live Chat Plugin for WordPress facebook	7.4	0%	Oct 16	Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
CVE-2024-45863	FT Facebook Thrift Facebook	5.3	0%	Sep 27	A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects
CVE-2024-45773	FT Facebook Thrift Facebook	7.5	0%	Sep 27	A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects
CVE-2024-35232	FA Facebook Facebook	3.7	1%	May 24	github.com/huandu/facebook may expose access_token in error message
CVE-2024-23347	MS Meta Spark Studio Facebook	7.8	0%	Jan 16	Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project
CVE-2023-49062	KA Katran Facebook	7.5	1%	Nov 28	Katran could disclose non-initialized kernel memory as part of an IP header
CVE-2023-5654	RE React-devtools Facebook	6.5	1%	Oct 19	The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is…
CVE-2023-44487 In wildKEV	PR Proxygen Facebook	7.5	100%	Oct 10	HTTP/2 Rapid Reset Attack Vulnerability
CVE-2023-45239	TP Tac Plus Facebook	9.8	2%	Oct 6	A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr,…
CVE-2023-30470	HE Hermes Facebook	9.8	1%	May 18	A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could…
CVE-2023-28753	NE Netconsd Facebook	9.8	2%	May 18	netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function
CVE-2023-28081	HE Hermes Facebook	9.8	1%	May 18	A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a…
CVE-2023-25933	HE Hermes Facebook	9.8	1%	May 18	A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted…
CVE-2023-24833	HE Hermes Facebook	7.5	1%	May 18	A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes…
CVE-2023-24832	HE Hermes Facebook	7.5	1%	May 18	A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the…
CVE-2023-23759	FI Fizz Facebook	7.5	1%	May 18	There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely
CVE-2023-23557	HE Hermes Facebook	9.8	1%	May 18	An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary…
CVE-2023-23556	HE Hermes Facebook	9.8	1%	May 18	An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code…
CVE-2022-36937	HH Hhvm Facebook	9.8	1%	May 10	HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension
CVE-2023-30792	LE Lexical Facebook	6.1	0%	Apr 29	Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted…
CVE-2022-4899	ZS Zstandard Facebook	7.5	2%	Mar 31	A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun
CVE-2022-36938	RE Redex Facebook	9.8	1%	Nov 11	DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code…
CVE-2022-40138	HE Hermes Facebook	9.8	1%	Oct 11	An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and…
CVE-2022-35289	HE Hermes Facebook	9.8	1%	Oct 11	A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary…
CVE-2022-32234	HE Hermes Facebook	9.8	1%	Oct 11	An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via…
CVE-2022-27810	HE Hermes Facebook	7.5	1%	Oct 6	It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript
CVE-2020-20094	IN Instagram Facebook	6.5	1%	Mar 23	Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially…
CVE-2020-20093	ME Messenger Facebook	6.5	2%	Mar 23	The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI…
CVE-2021-24044	HE Hermes Facebook	9.8	1%	Jan 15	By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error…
CVE-2021-24045	HE Hermes Facebook	9.8	1%	Dec 13	A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0
CVE-2019-3556	HH Hhvm Facebook	8.1	2%	Oct 26	HHVM supports the use of an "admin" server which accepts administrative requests over HTTP
CVE-2021-39207	PA Parlai Facebook	8.8	2%	Sep 10	parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets
CVE-2021-24040	PA Parlai Facebook	9.8	17%	Sep 10	Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code…
CVE-2021-24036	HH Hhvm Facebook	9.8	3%	Jul 23	Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code…
CVE-2021-24037	HE Hermes Facebook	9.8	2%	Jun 15	A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code…
CVE-2020-1920	RE React-native Facebook	7.5	1%	Jun 1	A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash
CVE-2021-24028	TH Thrift Facebook	9.8	2%	Apr 14	An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects