CWE-451 · User Interface (UI) Misrepresentation of Critical Information (page 2)
Page 2 of 4 — CVEs classified under CWE-451, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13956 | Medium | 4.2 | 2026-06-30 | Incorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2026-13948 | Low | 3.1 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-13945 | Low | 3.1 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-13941 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in SiteSettings in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-13916 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-13912 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2026-13907 | Medium | 4.2 | 2026-06-30 | Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI g… |
CVE-2026-13902 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-13895 | Medium | 4.2 | 2026-06-30 | Inappropriate implementation in Autofill in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-13892 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-13867 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2026-13860 | Medium | 4.2 | 2026-06-30 | Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2026-13857 | Medium | 4.2 | 2026-06-30 | Inappropriate implementation in Geometry in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-13842 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2026-13837 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-9106 | Medium | 5.5 | 2026-06-30 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization'… |
CVE-2026-12458 | Low | 3.1 | 2026-06-17 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-53829 | High | 8.0 | 2026-06-12 | OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers… |
CVE-2026-45650 | Medium | 4.3 | 2026-06-09 | User interface (ui) misrepresentation of critical information in Microsoft Bing allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-11300 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2026-11294 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-11286 | Medium | 4.3 | 2026-06-05 | Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11285 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-11254 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2026-11245 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2026-11232 | Medium | 5.4 | 2026-06-04 | Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffi… |
CVE-2026-11228 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-11227 | Medium | 6.5 | 2026-06-04 | Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name… |
CVE-2026-11225 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (… |
CVE-2026-11222 | Medium | 6.5 | 2026-06-04 | Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chrom… |
CVE-2026-11216 | Medium | 4.3 | 2026-06-04 | Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-11215 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted do… |
CVE-2026-11175 | High | 8.8 | 2026-06-04 | Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2026-11172 | High | 8.8 | 2026-06-04 | Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2026-11107 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-11019 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11001 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-10984 | Medium | 5.4 | 2026-06-04 | Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2019-25718 | High | 8.4 | 2026-06-01 | Dräger Infinity Explorer C700 contains a privilege escalation vulnerability that allows attackers to break out of kiosk mode and access the underlying operatin… |
CVE-2026-0096 | High | 7.8 | 2026-06-01 | In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could… |
CVE-2026-0094 | High | 7.8 | 2026-06-01 | In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insuffici… |
CVE-2026-0093 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of privilege with no additional execution priv… |
CVE-2026-0088 | High | 7.8 | 2026-06-01 | In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient UI. This could lea… |
CVE-2026-48851 | Low | 3.1 | 2026-05-25 | PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and… |
CVE-2026-9078 | Medium | 5.4 | 2026-05-25 | Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RT… |
CVE-2026-9110 | Medium | 4.2 | 2026-05-20 | Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to pe… |
CVE-2026-39309 | Medium | 5.5 | 2026-05-20 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the… |
CVE-2026-8964 | High | 7.5 | 2026-05-19 | Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8584 | Medium | 4.2 | 2026-05-14 | Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-8565 | Medium | 4.7 | 2026-05-14 | Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2026-8564 | Medium | 4.2 | 2026-05-14 | Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted H… |
CVE-2026-8561 | Medium | 5.4 | 2026-05-14 | Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromiu… |
CVE-2026-42891 | Medium | 6.5 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-40416 | Medium | 4.3 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-35429 | Medium | 4.3 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-46311 | High | 7.5 | 2026-05-12 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2026-34258 | Medium | 4.7 | 2026-05-12 | SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitat… |
CVE-2026-28964 | High | 7.5 | 2026-05-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may b… |
CVE-2026-44659 | Medium | 4.7 | 2026-05-11 | Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controll… |
CVE-2026-8019 | Medium | 5.4 | 2026-05-06 | Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-8015 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2026-8008 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2026-8006 | Medium | 5.4 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-7935 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chrom… |
CVE-2025-31951 | High | 8.8 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identif… |
CVE-2026-35371 | Low | 3.3 | 2026-04-22 | The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation inco… |
CVE-2026-3861 | Medium | 6.5 | 2026-04-16 | LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level di… |
CVE-2026-33119 | Medium | 5.4 | 2026-04-10 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-33118 | Medium | 4.3 | 2026-04-10 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-5906 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2026-5905 | Medium | 6.5 | 2026-04-08 | Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML… |
CVE-2026-5898 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-5897 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-5895 | Medium | 5.4 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a… |
CVE-2026-5891 | Medium | 4.3 | 2026-04-08 | Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-5882 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-5880 | Medium | 4.3 | 2026-04-08 | Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spo… |
CVE-2026-5878 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secu… |
CVE-2026-32971 | High | 7.1 | 2026-03-31 | OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the… |
CVE-2026-3889 | Medium | 6.5 | 2026-03-24 | Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9. |
CVE-2026-32318 | High | 7.6 | 2026-03-20 | Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability a… |
CVE-2026-32317 | High | 7.6 | 2026-03-20 | Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerabil… |
CVE-2026-32303 | High | 7.6 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the… |
CVE-2026-0385 | Medium | 5.0 | 2026-03-16 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability |
CVE-2026-3942 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3937 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2026-3935 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-3928 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-3927 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3925 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2026-2919 | Medium | 4.3 | 2026-03-09 | Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and tr… |
CVE-2025-68277 | Medium | 5.0 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure… |
CVE-2026-2634 | Critical | 9.8 | 2026-02-24 | Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-control… |
CVE-2026-26320 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unatten… |
CVE-2026-1658 | Medium | 5.3 | 2026-02-19 | User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. The vulnerability could b… |
CVE-2026-2032 | Medium | 4.3 | 2026-02-16 | Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof ar… |
CVE-2026-2323 | Medium | 4.3 | 2026-02-11 | Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2322 | Medium | 5.4 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2320 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2318 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific U… |