Facebook vulnerabilities

CVEs per yearBy the year they were published

1. 201919
2. 202038
3. 202118
4. 20226
5. 202312
6. 20242
7. 202437
8. 20256
9. 20269

Known exploitedNewest addition to KEV first

• CVE-2025-55177

  Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…

  Facebook · WhatsApp Desktop for Mac

  ExploitedMedium5.4
• CVE-2019-18426

  A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and…

  Facebook · WhatsApp Desktop

  ExploitedHigh8.2
• CVE-2019-3568

  A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone…

  Facebook · WhatsApp for Android

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-91096

  In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…

  Facebook · proxygen

  High7.5
• CVE-2026-91095

  In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…

  Facebook · proxygen

  Medium5.3
• CVE-2026-84895

  In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…

  Facebook · proxygen

  High7.3
• CVE-2026-66707

  WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

  Facebook · Facebook for WooCommerce

  High7.1
• CVE-2026-66705

  WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

  Facebook · Facebook for WordPress

  High7.1
• CVE-2026-44909

  Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…

  Facebook · proxygen

  High7.5
• CVE-2026-49059

  WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability

  Facebook · Facebook for WooCommerce

  Medium4.7
• CVE-2026-23866

  Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to…

  Facebook · WhatsApp for Android

  Medium4.3
• CVE-2026-23863

  An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL…

  Facebook · WhatsApp Desktop for Windows

  Medium6.5
• CVE-2025-55181

  Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…

  Facebook · proxygen

  Medium5.3