Facebook vulnerabilities
147 CVEs and advisories name Facebook as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-91096In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases befor
- CVE-2026-91095In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiSt
- CVE-2026-84895In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSe
- CVE-2026-66707WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66705WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-44909Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer.
- CVE-2026-49059WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability
- CVE-2026-23866Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android
- CVE-2026-23863An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents w
- CVE-2025-55181Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which bl
- CVE-2025-55179Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsAp
- CVE-2025-64296WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability
- CVE-2025-55177Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25
- CVE-2025-30403A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session.
- CVE-2025-30401A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file
- CVE-2020-36838Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
- CVE-2024-45863A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially r
- CVE-2024-45773A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution
- CVE-2023-49062Katran could disclose non-initialized kernel memory as part of an IP header.
- CVE-2023-38538A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app t
- CVE-2023-38537A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls
- CVE-2023-30470A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f73
- CVE-2023-28753netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function.
- CVE-2023-28081A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and
- CVE-2023-25933A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to
- CVE-2023-24833A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an a
- CVE-2023-24832A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to cra
- CVE-2023-23759There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely.
- CVE-2023-23557An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a mal
- CVE-2023-23556An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicio