157 CVEs across 59 Facebook products. Browse Facebook vulnerabilities, severities, and proof-of-concept exploits.
Facebook products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66707 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. |
CVE-2026-66705 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. |
CVE-2026-44909 | High | 7.5 | 2026-07-23 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-co… |
CVE-2026-49059 | Medium | 4.7 | 2026-05-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCom… |
CVE-2026-23870 | High | 7.5 | 2026-05-06 | A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes… |
CVE-2026-23866 | Medium | 4.3 | 2026-05-01 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26… |
CVE-2026-23863 | Medium | 6.5 | 2026-05-01 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL by… |
CVE-2026-23864 | High | 7.5 | 2026-01-26 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbop… |
CVE-2025-67779 | High | 7.5 | 2025-12-12 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific cas… |
CVE-2025-55184 | High | 7.5 | 2025-12-11 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, inclu… |
CVE-2025-55183 | Medium | 5.3 | 2025-12-11 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2… |
CVE-2025-55182 | Critical | 10.0 | 2025-12-03 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following… |
CVE-2025-55181 | Medium | 5.3 | 2025-12-02 | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing ev… |
CVE-2025-55179 | Medium | 5.4 | 2025-11-18 | Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23… |
CVE-2025-64296 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-55177 | Medium | 5.4 | 2025-08-29 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp… |
CVE-2025-30403 | High | 8.1 | 2025-07-11 | A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v20… |
CVE-2025-30401 | Medium | 6.7 | 2025-04-05 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler bas… |
CVE-2025-27591 | Medium | 6.8 | 2025-03-11 | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This cou… |
CVE-2020-36838 | High | 7.4 | 2024-10-16 | The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versio… |
CVE-2024-45863 | Medium | 5.3 | 2024-09-27 | A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other unde… |
CVE-2024-45773 | High | 7.5 | 2024-09-27 | A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirab… |
CVE-2024-23347 | High | 7.8 | 2024-01-16 | Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those… |
CVE-2023-49062 | High | 7.5 | 2023-11-28 | Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generati… |
CVE-2023-5654 | Medium | 6.5 | 2023-10-19 | The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-45239 | Critical | 9.8 | 2023-10-06 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the… |
CVE-2023-38538 | Medium | 5.0 | 2023-10-04 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexp… |
CVE-2023-38537 | Medium | 5.6 | 2023-10-04 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have re… |
CVE-2023-30470 | Critical | 9.8 | 2023-05-18 | A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65… |
CVE-2023-28753 | Critical | 9.8 | 2023-05-18 | netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap m… |
CVE-2023-28081 | Critical | 9.8 | 2023-05-18 | A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary co… |
CVE-2023-25933 | Critical | 9.8 | 2023-05-18 | A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary c… |
CVE-2023-24833 | High | 7.5 | 2023-05-18 | A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw… |
CVE-2023-24832 | High | 7.5 | 2023-05-18 | A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtim… |
CVE-2023-23759 | High | 7.5 | 2023-05-18 | There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client support… |
CVE-2023-23557 | Critical | 9.8 | 2023-05-18 | An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to… |
CVE-2023-23556 | Critical | 9.8 | 2023-05-18 | An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to exec… |
CVE-2022-36937 | Critical | 9.8 | 2023-05-10 | HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnera… |
CVE-2023-30792 | Medium | 6.1 | 2023-04-29 | Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being par… |
CVE-2022-4899 | High | 7.5 | 2023-03-31 | A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. |
CVE-2022-36938 | Critical | 9.8 | 2022-11-11 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially a… |
CVE-2022-40138 | Critical | 9.8 | 2022-10-11 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bou… |
CVE-2022-35289 | Critical | 9.8 | 2022-10-11 | A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially… |
CVE-2022-32234 | Critical | 9.8 | 2022-10-11 | An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute… |
CVE-2022-27810 | High | 7.5 | 2022-10-06 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was… |
CVE-2020-20094 | Medium | 6.5 | 2022-03-23 | Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofi… |
CVE-2020-20093 | Medium | 6.5 | 2022-03-23 | The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, wh… |
CVE-2021-24044 | Critical | 9.8 | 2022-01-15 | By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator fu… |
CVE-2021-24042 | Critical | 9.8 | 2022-01-04 | The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Bu… |
CVE-2021-24045 | Critical | 9.8 | 2021-12-13 | A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploi… |
CVE-2021-24041 | Critical | 9.8 | 2021-12-07 | A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-o… |
CVE-2019-3556 | High | 8.1 | 2021-10-26 | HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to outp… |
CVE-2021-39207 | High | 8.4 | 2021-09-10 | parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable… |
CVE-2021-24040 | Critical | 9.8 | 2021-09-10 | Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting… |
CVE-2021-24038 | High | 7.8 | 2021-08-19 | Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to… |
CVE-2021-24036 | Critical | 9.8 | 2021-07-23 | Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of… |
CVE-2021-24037 | Critical | 9.8 | 2021-06-15 | A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially exe… |
CVE-2021-24035 | Critical | 9.1 | 2021-06-11 | A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed… |
CVE-2020-1920 | High | 7.5 | 2021-06-01 | A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unres… |
CVE-2021-24028 | Critical | 9.8 | 2021-04-14 | An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects… |
CVE-2021-24218 | High | 8.8 | 2021-04-12 | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a l… |
CVE-2021-24217 | High | 8.1 | 2021-04-12 | The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied cre… |
CVE-2021-24027 | High | 7.5 | 2021-04-06 | A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to… |
CVE-2021-24026 | Critical | 9.8 | 2021-04-06 | A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v… |
CVE-2021-24029 | High | 7.5 | 2021-03-15 | A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC sp… |
CVE-2020-1900 | Critical | 9.8 | 2021-03-11 | When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. O… |
CVE-2020-1899 | High | 7.5 | 2021-03-11 | The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addr… |
CVE-2020-1898 | High | 7.5 | 2021-03-11 | The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to… |
CVE-2021-24030 | Critical | 9.8 | 2021-03-10 | The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to… |
CVE-2021-24025 | Critical | 9.8 | 2021-03-10 | Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading t… |
CVE-2020-1921 | High | 7.5 | 2021-03-10 | In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This iss… |
CVE-2020-1919 | High | 7.5 | 2021-03-10 | Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This is… |
CVE-2020-1918 | High | 7.5 | 2021-03-10 | In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory… |
CVE-2020-1917 | Critical | 9.8 | 2021-03-10 | xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard appen… |
CVE-2020-1916 | Critical | 9.8 | 2021-03-10 | An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This iss… |
CVE-2021-24033 | Medium | 5.6 | 2021-03-09 | react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This func… |
CVE-2021-24032 | Medium | 4.7 | 2021-03-04 | Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default perm… |
CVE-2021-24031 | Medium | 5.5 | 2021-03-04 | In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would… |
CVE-2020-1896 | Critical | 9.8 | 2021-02-02 | A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/… |
CVE-2020-1909 | Critical | 9.8 | 2020-11-03 | A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory cor… |
CVE-2020-1908 | Medium | 4.6 | 2020-11-03 | Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
CVE-2020-1915 | High | 7.5 | 2020-10-26 | An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a den… |
CVE-2020-1914 | Critical | 9.8 | 2020-10-08 | A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attack… |
CVE-2020-1907 | Critical | 9.8 | 2020-10-06 | A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsA… |
CVE-2020-1906 | High | 7.8 | 2020-10-06 | A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when… |
CVE-2020-1905 | Low | 3.3 | 2020-10-06 | Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have all… |
CVE-2020-1904 | Medium | 5.5 | 2020-10-06 | A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwr… |
CVE-2020-1903 | Medium | 5.5 | 2020-10-06 | An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
CVE-2020-1902 | High | 7.5 | 2020-10-06 | A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35… |
CVE-2020-1901 | Medium | 5.3 | 2020-10-06 | Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
CVE-2020-1913 | High | 8.1 | 2020-09-09 | An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause… |
CVE-2020-1912 | High | 8.1 | 2020-09-09 | An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87… |
CVE-2020-1911 | Critical | 9.8 | 2020-09-04 | A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe528… |
CVE-2020-1894 | High | 8.8 | 2020-09-03 | A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and W… |
CVE-2020-1891 | Critical | 9.8 | 2020-09-03 | A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone p… |
CVE-2020-1890 | High | 7.5 | 2020-09-03 | A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticke… |
CVE-2020-1889 | Critical | 10.0 | 2020-09-03 | A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege i… |
CVE-2020-1886 | High | 8.8 | 2020-09-03 | A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a… |
CVE-2019-11928 | Medium | 6.1 | 2020-09-03 | An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially craf… |