https://vulnogram.org/ Most recent CVEs assigned by Meta Platforms, Inc. (meta). https://vulnogram.org/seaview/icons/meta.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-104026 https://vulnogram.org/CVE-2026-104026 In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/… High Fri, 02 Oct 2026 14:06:02 GMT https://vulnogram.org/CVE-2026-92172 https://vulnogram.org/CVE-2026-92172 Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a br… High Wed, 30 Sep 2026 20:26:49 GMT https://vulnogram.org/CVE-2026-92173 https://vulnogram.org/CVE-2026-92173 Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would all… Critical Network Exploitable Wed, 30 Sep 2026 20:26:33 GMT https://vulnogram.org/CVE-2026-91096 https://vulnogram.org/CVE-2026-91096 In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying t… High Network Exploitable Mon, 28 Sep 2026 20:44:57 GMT https://vulnogram.org/CVE-2026-91095 https://vulnogram.org/CVE-2026-91095 In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed thos… Medium Network Exploitable Mon, 28 Sep 2026 20:44:45 GMT https://vulnogram.org/CVE-2026-84895 https://vulnogram.org/CVE-2026-84895 In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last refer… High Network Exploitable Mon, 28 Sep 2026 20:44:34 GMT https://vulnogram.org/CVE-2026-84894 https://vulnogram.org/CVE-2026-84894 In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stre… High Network Exploitable Mon, 28 Sep 2026 18:40:55 GMT https://vulnogram.org/CVE-2026-44909 https://vulnogram.org/CVE-2026-44909 Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, cau… High Thu, 23 Jul 2026 16:27:01 GMT https://vulnogram.org/CVE-2026-44907 https://vulnogram.org/CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel,… High Tue, 21 Jul 2026 16:03:32 GMT https://vulnogram.org/CVE-2026-23870 https://vulnogram.org/CVE-2026-23870 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-… High Wed, 06 May 2026 16:24:55 GMT https://vulnogram.org/CVE-2026-23866 https://vulnogram.org/CVE-2026-23866 Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary UR… Medium Fri, 01 May 2026 16:02:03 GMT https://vulnogram.org/CVE-2026-23863 https://vulnogram.org/CVE-2026-23863 An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an execut… Medium Fri, 01 May 2026 16:01:39 GMT https://vulnogram.org/CVE-2026-23869 https://vulnogram.org/CVE-2026-23869 A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0… High Network Exploitable Wed, 08 Apr 2026 19:11:08 GMT https://vulnogram.org/CVE-2026-23868 https://vulnogram.org/CVE-2026-23868 Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. High Tue, 10 Mar 2026 18:53:25 GMT https://vulnogram.org/CVE-2026-23865 https://vulnogram.org/CVE-2026-23865 An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixe… Medium Mon, 02 Mar 2026 16:09:42 GMT https://vulnogram.org/CVE-2026-23864 https://vulnogram.org/CVE-2026-23864 Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially craft… High Network Exploitable Mon, 26 Jan 2026 19:16:38 GMT https://vulnogram.org/CVE-2025-67779 https://vulnogram.org/CVE-2025-67779 It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe… High Thu, 11 Dec 2025 23:36:20 GMT https://vulnogram.org/CVE-2025-55184 https://vulnogram.org/CVE-2025-55184 A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react… High Thu, 11 Dec 2025 20:05:01 GMT https://vulnogram.org/CVE-2025-55183 https://vulnogram.org/CVE-2025-55183 An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, a… Medium Thu, 11 Dec 2025 20:04:48 GMT https://vulnogram.org/CVE-2025-55182 https://vulnogram.org/CVE-2025-55182 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack… Critical Known Exploited Wed, 03 Dec 2025 15:40:56 GMT https://vulnogram.org/CVE-2025-55181 https://vulnogram.org/CVE-2025-55181 Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue l… Medium Tue, 02 Dec 2025 22:13:31 GMT https://vulnogram.org/CVE-2025-55179 https://vulnogram.org/CVE-2025-55179 Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL o… Medium Tue, 18 Nov 2025 13:56:31 GMT https://vulnogram.org/CVE-2025-55178 https://vulnogram.org/CVE-2025-55178 Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution. Medium Network Exploitable Wed, 24 Sep 2025 18:31:28 GMT