CVE Program partner

Meta

Meta Platforms, Inc.

API
CVEs, 365 days2223 all time, 0 rejected
Quality53%median 99%
CVSS by the CNA59%share of records
CWE0%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA40%lower is better
OrganisationMeta Platforms, Inc.
RoleCNA
TypeVendor, Open Source, Researcher
Reports tomitre
ScopeMeta-supported open source projects, mobile apps, and other software, as well as vulnerabilities in third-party software discovered by Meta that are not in another CNA’s scope; see: <a href='https://www.facebook.com/whitehat' target='_blank'>https://www.facebook.com/whitehat</a> and <a href='https://github.com/facebook/' target='_blank'>https://github.com/facebook/</a>.
Advisorieshttps://www.facebook.com/security

Latest CVEs · RSS

  • CVE-2026-104026 2026-10-02
    In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if clone
  • CVE-2026-92172 2026-09-30
    Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity t
  • CVE-2026-92173 2026-09-30
    Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIden
  • CVE-2026-91096 2026-09-28
    In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) fa
  • CVE-2026-91095 2026-09-28
    In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could retu
  • CVE-2026-84895 2026-09-28
    In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSess
  • CVE-2026-84894 2026-09-28
    In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under p
  • CVE-2026-44909 2026-07-23 · CVSS 7.5
    Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-con
  • CVE-2026-44907 2026-07-21 · CVSS 7.5
    A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU u
  • CVE-2026-23870 2026-05-06 · CVSS 7.5
    A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes,
  • CVE-2026-23866 2026-05-01 · CVSS 4.3
    Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.
  • CVE-2026-23863 2026-05-01 · CVSS 6.5
    An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL byt
  • CVE-2026-23869 2026-04-08 · CVSS 7.5
    A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and r
  • CVE-2026-23868 2026-03-10
    Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to tri
  • CVE-2026-23865 2026-03-02 · CVSS 5.3
    An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read o
  • CVE-2026-23864 2026-01-26
    Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopa
  • CVE-2025-67779 2025-12-11 · CVSS 7.5
    It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case
  • CVE-2025-55184 2025-12-11 · CVSS 7.5
    A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, includ
  • CVE-2025-55183 2025-12-11 · CVSS 5.3
    An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1
  • CVE-2025-55182 2025-12-03 · CVSS 10.0
    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following p
  • CVE-2025-55181 2025-12-02 · CVSS 5.3
    Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing eve
  • CVE-2025-55179 2025-11-18 · CVSS 5.4
    Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.8
  • CVE-2025-55178 2025-09-24
    Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.

All CVE Program partners