Skip to content
Noroxi

Facebook records

132 published records for vendor Facebook. 2 of them have been exploited in the wild (listed in CISA KEV) and 3 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
2 · 1.5%
Weaponized
3 · 2.3%
Pre-auth RCE
28
With a fix record
35.6%
Median publish → KEV
1 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

132 records
  • CVE-2025-55182
    100Now

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    facebook · reactDec 3, 2025

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2025-55184
    49Plan

    A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.

    HighCVSS 7.5Proof of conceptEPSS 64%

    facebook · reactDec 11, 2025

  • CVE-2008-0660
    48Plan

    Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and

    CriticalCVSS 9.3Proof of conceptEPSS 37%

    aurigma · image uploader activex controlFeb 7, 2008

  • CVE-2008-5711
    47Plan

    Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3WeaponizedEPSS 32%

    facebook · photouploaderDec 24, 2008

  • CVE-2021-24040
    44Plan

    Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicio

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    facebook · parlaiSep 10, 2021

  • CVE-2025-55183
    40Plan

    An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.

    MediumCVSS 5.3Proof of conceptEPSS 61%

    vercel · next.jsDec 11, 2025

  • CVE-2019-11929
    40Plan

    Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading

    CriticalCVSS 9.8No exploitEPSS 4%

    facebook · hhvmOct 2, 2019

  • CVE-2021-24036
    40Plan

    Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with

    CriticalCVSS 9.8No exploitEPSS 3%

    facebook · follyJul 22, 2021

  • CVE-2019-11930
    40Plan

    An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution.

    CriticalCVSS 9.8No exploitEPSS 3%

    facebook · hhvmDec 4, 2019

  • CVE-2018-6342
    40Plan

    react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an edito

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · react-dev-utilsDec 31, 2018

  • CVE-2020-1896
    40Plan

    A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.c

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hermesFeb 2, 2021

  • CVE-2020-1914
    40Plan

    A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7f

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hermesOct 8, 2020

  • CVE-2018-6331
    40Plan

    Buck parser-cache command loads/saves state using Java serialized object.

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · buckDec 31, 2018

  • CVE-2018-6333
    40Plan

    The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering.

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · nuclideDec 31, 2018

  • CVE-2016-6871
    40Plan

    Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmFeb 17, 2017

  • CVE-2019-11926
    40Plan

    Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmSep 6, 2019

  • CVE-2023-45239
    40Plan

    A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    facebook · tac plusOct 6, 2023

  • CVE-2016-6875
    40Plan

    Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmFeb 17, 2017

  • CVE-2016-6873
    40Plan

    Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmFeb 17, 2017

  • CVE-2016-6872
    40Plan

    Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmFeb 17, 2017

  • CVE-2016-6870
    40Plan

    Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functions in Facebook HHVM before 3.15.0 allows

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmFeb 17, 2017

  • CVE-2019-11925
    40Plan

    Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-of-bounds memory via

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmSep 6, 2019

  • CVE-2019-11921
    40Plan

    An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 w

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · proxygenJul 25, 2019

  • CVE-2016-6874
    40Plan

    The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to r

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hhvmFeb 17, 2017