https://vulnogram.org/ Most recent CVEs assigned by facebook (facebook). https://vulnogram.org/seaview/icons/facebook.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-55177 https://vulnogram.org/CVE-2025-55177 Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content… Medium Known Exploited Fri, 29 Aug 2025 15:50:28 GMT https://vulnogram.org/CVE-2025-54952 https://vulnogram.org/CVE-2025-54952 An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit… Critical Network Exploitable Thu, 07 Aug 2025 23:08:39 GMT https://vulnogram.org/CVE-2025-54951 https://vulnogram.org/CVE-2025-54951 A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78a… Critical Network Exploitable Thu, 07 Aug 2025 23:06:02 GMT https://vulnogram.org/CVE-2025-54950 https://vulnogram.org/CVE-2025-54950 An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit b6b7a16df5e7852d976d8c34c8a7… Critical Network Exploitable Thu, 07 Aug 2025 23:03:03 GMT https://vulnogram.org/CVE-2025-54949 https://vulnogram.org/CVE-2025-54949 A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be Critical Network Exploitable Thu, 07 Aug 2025 22:58:23 GMT https://vulnogram.org/CVE-2025-30405 https://vulnogram.org/CVE-2025-30405 An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to com… Critical Network Exploitable Thu, 07 Aug 2025 22:55:40 GMT https://vulnogram.org/CVE-2025-30404 https://vulnogram.org/CVE-2025-30404 An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc740… Critical Network Exploitable Thu, 07 Aug 2025 22:46:57 GMT https://vulnogram.org/CVE-2025-30403 https://vulnogram.org/CVE-2025-30403 A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00. High Network Exploitable Fri, 11 Jul 2025 18:26:51 GMT https://vulnogram.org/CVE-2025-30402 https://vulnogram.org/CVE-2025-30402 A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c4… High Network Exploitable Fri, 11 Jul 2025 17:39:26 GMT https://vulnogram.org/CVE-2025-30401 https://vulnogram.org/CVE-2025-30401 A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused… Medium Sat, 05 Apr 2025 11:47:54 GMT https://vulnogram.org/CVE-2025-27591 https://vulnogram.org/CVE-2025-27591 A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink att… Medium Tue, 11 Mar 2025 18:29:21 GMT https://vulnogram.org/CVE-2025-27363 https://vulnogram.org/CVE-2025-27363 An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed… High Known Exploited Tue, 11 Mar 2025 13:28:31 GMT https://vulnogram.org/CVE-2024-50050 https://vulnogram.org/CVE-2024-50050 Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead. Medium Wed, 23 Oct 2024 13:35:17 GMT https://vulnogram.org/CVE-2024-49400 https://vulnogram.org/CVE-2024-49400 Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead… Critical Network Exploitable Thu, 17 Oct 2024 17:15:17 GMT https://vulnogram.org/CVE-2024-45863 https://vulnogram.org/CVE-2024-45863 A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.0… Medium Fri, 27 Sep 2024 13:50:29 GMT https://vulnogram.org/CVE-2024-45773 https://vulnogram.org/CVE-2024-45773 A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00. High Fri, 27 Sep 2024 13:49:54 GMT https://vulnogram.org/CVE-2024-23347 https://vulnogram.org/CVE-2024-23347 Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application. High Tue, 16 Jan 2024 17:57:20 GMT https://vulnogram.org/CVE-2023-49062 https://vulnogram.org/CVE-2023-49062 Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identification fiel… Tue, 28 Nov 2023 15:45:42 GMT https://vulnogram.org/CVE-2023-45239 https://vulnogram.org/CVE-2023-45239 A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remo… Fri, 06 Oct 2023 17:16:16 GMT https://vulnogram.org/CVE-2023-38538 https://vulnogram.org/CVE-2023-38538 A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability. Medium Wed, 04 Oct 2023 19:10:49 GMT https://vulnogram.org/CVE-2023-38537 https://vulnogram.org/CVE-2023-38537 A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability. Medium Wed, 04 Oct 2023 19:09:58 GMT https://vulnogram.org/CVE-2023-30470 https://vulnogram.org/CVE-2023-30470 A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code execution. Note tha… Critical Network Exploitable Thu, 18 May 2023 21:27:57 GMT https://vulnogram.org/CVE-2023-28753 https://vulnogram.org/CVE-2023-28753 netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap memory corruption with attacker controlled data. Critical Network Exploitable Thu, 18 May 2023 21:27:44 GMT https://vulnogram.org/CVE-2023-28081 https://vulnogram.org/CVE-2023-28081 A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases w… Critical Network Exploitable Thu, 18 May 2023 21:26:49 GMT https://vulnogram.org/CVE-2023-25933 https://vulnogram.org/CVE-2023-25933 A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. Note that this is only exploitable in cases where Hermes is u… Critical Network Exploitable Thu, 18 May 2023 21:24:58 GMT https://vulnogram.org/CVE-2023-24833 https://vulnogram.org/CVE-2023-24833 A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is us… High Network Exploitable Thu, 18 May 2023 21:24:11 GMT https://vulnogram.org/CVE-2023-24832 https://vulnogram.org/CVE-2023-24832 A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only expl… High Network Exploitable Thu, 18 May 2023 21:24:01 GMT https://vulnogram.org/CVE-2023-23759 https://vulnogram.org/CVE-2023-23759 There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHell… High Network Exploitable Thu, 18 May 2023 21:21:02 GMT https://vulnogram.org/CVE-2023-23557 https://vulnogram.org/CVE-2023-23557 An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases wher… Critical Network Exploitable Thu, 18 May 2023 21:19:41 GMT https://vulnogram.org/CVE-2023-23556 https://vulnogram.org/CVE-2023-23556 An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in… Critical Network Exploitable Thu, 18 May 2023 21:16:43 GMT https://vulnogram.org/CVE-2022-36937 https://vulnogram.org/CVE-2022-36937 HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.17… Critical Network Exploitable Wed, 10 May 2023 18:28:20 GMT https://vulnogram.org/CVE-2023-30792 https://vulnogram.org/CVE-2023-30792 Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources. Medium Network Exploitable Sat, 29 Apr 2023 02:21:49 GMT https://vulnogram.org/CVE-2022-36943 https://vulnogram.org/CVE-2022-36943 SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the… High Network Exploitable Tue, 03 Jan 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-36938 https://vulnogram.org/CVE-2022-36938 DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file. Critical Network Exploitable Thu, 10 Nov 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-40138 https://vulnogram.org/CVE-2022-40138 An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable… Tue, 11 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-35289 https://vulnogram.org/CVE-2022-35289 A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the ap… Tue, 11 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-32234 https://vulnogram.org/CVE-2022-32234 An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the applicati… Tue, 11 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-27810 https://vulnogram.org/CVE-2022-27810 It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Herme… Thu, 06 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-27492 https://vulnogram.org/CVE-2022-27492 An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file. High Fri, 23 Sep 2022 14:00:14 GMT https://vulnogram.org/CVE-2022-36934 https://vulnogram.org/CVE-2022-36934 An integer overflow in WhatsApp could result in remote code execution in an established video call. Critical Network Exploitable Thu, 22 Sep 2022 21:30:11 GMT https://vulnogram.org/CVE-2022-38216 https://vulnogram.org/CVE-2022-38216 An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creatin… Tue, 16 Aug 2022 00:34:54 GMT https://vulnogram.org/CVE-2022-36312 https://vulnogram.org/CVE-2022-36312 Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models. Tue, 16 Aug 2022 00:34:33 GMT https://vulnogram.org/CVE-2022-36311 https://vulnogram.org/CVE-2022-36311 Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models. Tue, 16 Aug 2022 00:34:12 GMT https://vulnogram.org/CVE-2022-36310 https://vulnogram.org/CVE-2022-36310 Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity a… Tue, 16 Aug 2022 00:33:45 GMT https://vulnogram.org/CVE-2022-36309 https://vulnogram.org/CVE-2022-36309 Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVeloc… Tue, 16 Aug 2022 00:33:24 GMT https://vulnogram.org/CVE-2022-36308 https://vulnogram.org/CVE-2022-36308 Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to man… Tue, 16 Aug 2022 00:32:57 GMT https://vulnogram.org/CVE-2022-36307 https://vulnogram.org/CVE-2022-36307 The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity and AirSpeed models. Tue, 16 Aug 2022 00:32:34 GMT https://vulnogram.org/CVE-2022-36306 https://vulnogram.org/CVE-2022-36306 An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 runni… Tue, 16 Aug 2022 00:32:07 GMT https://vulnogram.org/CVE-2022-24949 https://vulnogram.org/CVE-2022-24949 A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen(). Tue, 16 Aug 2022 00:30:36 GMT https://vulnogram.org/CVE-2022-24952 https://vulnogram.org/CVE-2022-24952 Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number and a local bug triggered by invalid input sent directly to the IPC socket. Tue, 16 Aug 2022 00:00:00 GMT