Read the docs

Meta

Records192All Threatist records
Exploited (KEV)5In CISA KEV
CVSS critical74CVSS 9.0–10.0
CVSS high79CVSS 7.0–8.9

Exploited now

Meta records in CISA KEV
TI-2025-34861 Meta React Server Components Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-12-05TI-2025-34857 Meta Platforms WhatsApp Incorrect Authorization Vulnerability Priority HIGH 84KEV 2025-09-02TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2019-13416 WhatsApp Cross-Site Scripting Vulnerability Priority CRITICAL 93KEV 2022-05-23TI-2019-02633 WhatsApp VOIP Stack Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2022-04-19

Components

Products in the NVD configurations · select one to filter the records
Hhvm 40 records MEDIUM Hermes 20 records MEDIUM Thrift 9 records MEDIUM Hiphop Virtual Machine 7 records MEDIUM Proxygen 7 records CRITICAL React 6 records CRITICAL Facebook 4 records HIGH Zstandard 4 records MEDIUM

Records

7 records in Hiphop Virtual Machine · all components

TI-2019-02635 CVE-2019-3570 · GHSA-4335-6g7p-5556

Heap-based buffer overflow in Meta HHVM

Priority MEDIUM 45

Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01679 Published 2019-07-18 No fix listed CWE-122
TI-2014-01747 CVE-2014-2208 · GHSA-23pm-573j-2rqj

CRLF injection vulnerability in the LightProcess protocol implementation in…

Priority LOW 38

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by ente…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02684 Published 2014-12-28 No fix listed CWE-94
TI-2014-05127 CVE-2014-6229 · GHSA-fgvh-xmpw-4vhf

The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine…

Priority LOW 26

The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obta…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01681 Published 2014-12-28 No fix listed CWE-200
TI-2014-04389 CVE-2014-5386 · GHSA-rrcg-p2f6-8mv2

The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook…

Priority LOW 26

The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defe…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01516 Published 2014-12-28 No fix listed CWE-310
Open these records in search →