Meta vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20232
3. 20241
4. 20255
5. 20264

Known exploitedNewest addition to KEV first

• CVE-2025-55182

  A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…

  Meta · react-server-dom-webpack

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-44907

  A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU…

  Meta · react-server-dom-turbopack

  High7.5
• CVE-2026-23870

  A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server…

  Meta · react-server-dom-turbopack

  High7.5
• CVE-2026-23869

  A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and…

  Meta · react-server-dom-turbopack

  High7.5
• CVE-2026-23864

  Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel,…

  Meta · react-server-dom-webpack

  High7.5
• CVE-2025-67779

  It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific…

  Meta · react-server-dom-parcel

  High7.5
• CVE-2025-55184

  A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1,…

  Meta · react-server-dom-webpack

  High7.5
• CVE-2025-55183

  An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and…

  Meta · react-server-dom-webpack

  Medium5.3
• CVE-2025-55182

  A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…

  Meta · react-server-dom-webpack

  ExploitedCritical10.0
• CVE-2025-30259

  The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow…

  Meta · WhatsApp cloud service

  Low3.5
• CVE-2024-49400

  Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured…

  Meta · Tacquito

  Critical9.8