How many CVEs does facebook have?

facebook has 187 published CVE records since 2008, including 17 in the last two years.

How many facebook CVEs are in CISA KEV?

Yes — 5 of facebook's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which facebook products have the most CVEs?

The facebook products with the most published CVEs are HHVM, WhatsApp for Android, WhatsApp Business for Android, Hermes, WhatsApp for iOS.

What are the most common weakness types in facebook CVEs?

facebook's CVEs most often map to these CWE weakness types: CWE-122 (Heap-based Buffer Overflow), CWE-400 (Uncontrolled Resource Consumption), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write).

Are there public exploits for facebook vulnerabilities?

Yes — 15 of facebook's CVEs have a known public exploit.

How many critical facebook vulnerabilities are there?

facebook has 74 critical and 71 high-severity CVEs.

What is the average severity of facebook CVEs?

The average CVSS base score across facebook's scored CVEs is 8.0.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

187 CVEs

5 in CISA KEV

facebook Vulnerabilities

Name: facebook vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for facebook.

187

Total CVEs

Published

5

In CISA KEV

Exploited in the wild

15

Public exploits

PoC or exploit code

8.0

Avg CVSS

2008–2026

Overview

facebook has 187 published CVE records since 2008, of which 5 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 8.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting facebook products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on facebook's vulnerability posture, as a share of its 187 published CVEs.

Average CVSS: 8.0
Critical / high: 78%
Actively exploited (KEV): 3%
Public exploit available: 8%
Patch available: 94%

Severity and exploitation

How the CVSS severity of facebook's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical74

High71

Medium40

Low2

In CISA’s Known Exploited Vulnerabilities catalog

5

5 of facebook's CVEs are confirmed exploited in the wild.

Public exploits

15

15 of facebook's CVEs have a known public exploit available.

Most affected products

The facebook products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in facebook CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish facebook CVE records.

Disclosure activity by year

How many facebook CVEs were published each year.

2019

40

2020

36

2021

30

2022

9

2023

18

2024

6

2025

12

2026

5

Latest facebook CVEs

The most recently disclosed vulnerabilities affecting facebook.

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
CWE-441
Medium · CVSS 5.3
EPSS 0.2%2026-06-15
WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability
CWE-601
Medium · CVSS 4.7
EPSS 0.2%2026-05-27
Medium vulnerability · 2026-05-01
CWE-940
Medium · CVSS 4.3
EPSS 0.5%2026-05-01
Medium vulnerability · 2026-05-01
CWE-158
Medium · CVSS 6.5
EPSS 0.5%2026-05-01
High vulnerability · 2026-01-26
CWE-502
High · CVSS 7.5
EPSS 2.5%2026-01-26
@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development
CWE-22
High · CVSS 7.5
EPSS 0.6%2025-12-16
High vulnerability · 2025-12-11
CWE-400
High · CVSS 7.5
EPSS 19.2%2025-12-11
High vulnerability · 2025-12-11
High · CVSS 7.5
EPSS 65.6%2025-12-11
Medium vulnerability · 2025-12-11
Medium · CVSS 5.3
EPSS 62.4%2025-12-11
Critical vulnerability · 2025-12-03
CISA KEV
Critical · CVSS 10.0
EPSS 99.6%2025-12-03
Medium vulnerability · 2025-12-02
CWE-834
Medium · CVSS 5.3
EPSS 0.3%2025-12-02
Medium vulnerability · 2025-11-18
Medium · CVSS 5.4
EPSS 0.2%2025-11-18

Track new facebook CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor facebook CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

curl192 CVEs LabRedesCefetRJ191 CVEs MantisBT190 CVEs Pivotal189 CVEs themerex187 CVEs github185 CVEs tcpdump185 CVEs HP Inc.184 CVEs

Browse all vendors

Frequently asked questions

Common questions about facebook vulnerabilities.

How many CVEs does facebook have?: facebook has 187 published CVE records since 2008, including 17 in the last two years.
How many facebook CVEs are in CISA KEV?: Yes — 5 of facebook's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which facebook products have the most CVEs?: The facebook products with the most published CVEs are HHVM, WhatsApp for Android, WhatsApp Business for Android, Hermes, WhatsApp for iOS.
What are the most common weakness types in facebook CVEs?: facebook's CVEs most often map to these CWE weakness types: CWE-122 (Heap-based Buffer Overflow), CWE-400 (Uncontrolled Resource Consumption), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write).
Are there public exploits for facebook vulnerabilities?: Yes — 15 of facebook's CVEs have a known public exploit.
How many critical facebook vulnerabilities are there?: facebook has 74 critical and 71 high-severity CVEs.
What is the average severity of facebook CVEs?: The average CVSS base score across facebook's scored CVEs is 8.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track facebook vulnerabilities

Monitor new facebook vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing