Vendor
147 known vulnerabilities.
Facebook at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 3 | 0 |
| Aug 2026 | 2 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 3 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 1 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
HHVM 31
WhatsApp for Android 23
WhatsApp Business for Android 20
Hermes 20
WhatsApp for iOS 19
WhatsApp Business for iOS 15
proxygen 12
Facebook Thrift 11
WhatsApp Desktop 5
WhatsApp for Windows Phone 4
WhatsApp Desktop for Mac 4
WhatsApp Desktop for Windows 4
fizz 3
folly 3
Zstandard 3
osquery 3
Facebook for WooCommerce 3
Wangle 2
WhatsApp Android 2
WhatsApp iPhone 2
WhatsApp Business for iPhone 2
Mcrouter 2
Oculus Desktop 2
mvfst 2
react-dev-utils 2
Redex 1
WhatsApp for KaiOS 1
Katran 1
WhatsApp Enterprise Client 1
Facebook Gameroom 1
WhatsApp for Tizen 1
WhatsApp for Portal 1
ParlAI 1
react-native 1
Facebook Chat Plugin – Live Chat Plugin for WordPress 1
netconsd 1
Facebook for WordPress 1
Buck 1
react-dom 1
Nuclide 1
147 results · Feed
-
High 7.5
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::dest…
-
Medium 5.3
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction:…
-
High 7.3
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after call…
-
High 7.1
WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
-
High 7.1
WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
-
High 7.5
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticat…
-
Medium 4.7
WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCommerce: from n/a through 3.7.0.
-
Medium 4.3
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and…
-
Medium 6.5
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously …
-
Medium 5.3
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQui…
-
Medium 5.4
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.…
-
Medium 5.3
WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
-
Medium 5.4
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp B…
KEV Sep 2, 2025 -
High 8.1
A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This i…
-
Medium 6.7CVE-2025-30401 EPSS 21%
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type b…
-
High 7.4
Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to c…
-
Medium 5.3
A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to c…
-
High 7.5
A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially res…
-
Unscored —
Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulati…
-
Medium 5.0
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could h…
-
Medium 5.6
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incom…
-
Critical 9.8
A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prio…
-
Critical 9.8CVE-2023-28753 Public exploit
netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could…
-
Critical 9.8
A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause a…
-
Critical 9.8
A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a m…
-
High 7.5
A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could h…
-
High 7.5
A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used …
-
High 7.5
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. T…
-
Critical 9.8
An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad c…
-
Critical 9.8
An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have b…
-
Critical 9.8
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extensio…
-
Critical 9.8
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loadi…
-
Unscored —
A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8…
-
Unscored —
An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1…
-
Unscored —
An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, co…
-
Unscored —
It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific malicious…
-
Critical 9.8
Access of Resource Using Incompatible Type in Hermes
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a…
-
Critical 9.8
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp…
-
Unscored —
A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior t…
-
Unscored —
A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Androi…