Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,302All CVEsplus 18,889 rejected
- 656Last 24 hours2,963 in the last 7 days
- 17,335Last 30 days1,579 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 4 | 0 | 0 | 9 | 147 |
| 2025 | 0 | 1 | 5 | 0 | 0 | 6 | 138 |
| 2024 | 0 | 2 | 1 | 0 | 0 | 3 | 132 |
| 2023 | 7 | 4 | 2 | 0 | 0 | 13 | 129 |
| 2022 | 6 | 1 | 0 | 0 | 0 | 7 | 116 |
| 2021 | 14 | 10 | 3 | 0 | 0 | 27 | 109 |
| 2020 | 8 | 17 | 5 | 1 | 0 | 31 | 82 |
| 2019 | 20 | 14 | 3 | 0 | 0 | 37 | 51 |
| 2018 | 4 | 8 | 2 | 0 | 0 | 14 | 14 |
| Title | ||
|---|---|---|
| CVE-2026-91096 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…Facebook · proxygen | High7.5 |
| CVE-2026-91095 | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…Facebook · proxygen | Medium5.3 |
| CVE-2026-84895 | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…Facebook · proxygen | High7.3 |
| CVE-2026-66707 | WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerabilityFacebook · Facebook for WooCommerce | High7.1 |
| CVE-2026-66705 | WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityFacebook · Facebook for WordPress | High7.1 |
| CVE-2026-44909 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…Facebook · proxygen | High7.5 |
| CVE-2026-49059 | WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerabilityFacebook · Facebook for WooCommerce | Medium4.7 |
| CVE-2026-23866 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to…Facebook · WhatsApp for Android | Medium4.3 |
| CVE-2026-23863 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL…Facebook · WhatsApp Desktop for Windows | Medium6.5 |
| CVE-2025-55181 | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…Facebook · proxygen | Medium5.3 |
| CVE-2025-55179 | Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac…Facebook · WhatsApp Business for iOS | Medium5.4 |
| CVE-2025-64296 | WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerabilityFacebook · Facebook for WooCommerce | Medium5.3 |
| CVE-2025-55177 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…ExploitedFacebook · WhatsApp Desktop for Mac | Medium5.4 |
| CVE-2025-30403 | A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to…Facebook · mvfst | High8.1 |
| CVE-2025-30401 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler…Facebook · WhatsApp Desktop for Windows | Medium6.7 |
| CVE-2020-36838 | Facebook Chat Plugin <= 1.5 - Missing Capabilities Checkfacebook · Facebook Chat Plugin – Live Chat Plugin for WordPress | High7.4 |
| CVE-2024-45863 | A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other…Facebook · Facebook Thrift | Medium5.3 |
| CVE-2024-45773 | A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other…Facebook · Facebook Thrift | High7.5 |
| CVE-2023-49062 | Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet…Facebook · Katran | High7.5 |
| CVE-2023-38538 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or…Facebook · WhatsApp Desktop for Mac | Medium5.0 |
| CVE-2023-38537 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have…Facebook · WhatsApp Desktop for Mac | Medium5.6 |
| CVE-2023-30470 | A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit…Facebook · Hermes | Critical9.8 |
| CVE-2023-28753 | netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap…Facebook · netconsd | Critical9.8 |
| CVE-2023-28081 | A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary…Facebook · Hermes | Critical9.8 |
| CVE-2023-25933 | A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary…Facebook · Hermes | Critical9.8 |
| CVE-2023-24833 | A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw…Facebook · Hermes | High7.5 |
| CVE-2023-24832 | A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes…Facebook · Hermes | High7.5 |
| CVE-2023-23759 | There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client…Facebook · fizz | High7.5 |
| CVE-2023-23557 | An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to…Facebook · Hermes | Critical9.8 |
| CVE-2023-23556 | An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to…Facebook · Hermes | Critical9.8 |
| CVE-2022-36937 | HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published…Facebook · HHVM | Critical9.8 |
| CVE-2022-36938 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially…Facebook · Redex | Critical9.8 |
| CVE-2022-40138 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform…Facebook · Hermes | Critical9.8 |
| CVE-2022-35289 | A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially…Facebook · Hermes | Critical9.8 |
| CVE-2022-32234 | An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute…Facebook · Hermes | Critical9.8 |
| CVE-2022-27810 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was…Facebook · Hermes | High7.5 |
| CVE-2021-24044 | By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator…Facebook · Hermes | Critical9.8 |
| CVE-2021-24042 | The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp…Facebook · WhatsApp Desktop | Critical9.8 |
| CVE-2021-24045 | A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only…Facebook · Hermes | Critical9.8 |
| CVE-2021-24041 | A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an…Facebook · WhatsApp Business for Android | Critical9.8 |
| CVE-2019-3556 | HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to…Facebook · HHVM | High8.1 |
| CVE-2021-24040 | Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting…Facebook · ParlAI | Critical9.8 |
| CVE-2021-24038 | Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to…Facebook · Oculus Desktop | High7.8 |
| CVE-2021-24036 | Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of…Facebook · folly | Critical9.8 |
| CVE-2021-24037 | A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially…Facebook · Hermes | Critical9.8 |
| CVE-2021-24035 | A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed…Facebook · WhatsApp Business for Android | Critical9.1 |
| CVE-2020-1920 | A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become…Facebook · react-native | High7.5 |
| CVE-2021-24028 | An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects.…Facebook · Facebook Thrift | Critical9.8 |
| CVE-2021-24027 | A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to…Facebook · WhatsApp Business for Android | High7.5 |
| CVE-2021-24026 | A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to…Facebook · WhatsApp Business for iOS | Critical9.8 |