CWE-451 · User Interface (UI) Misrepresentation of Critical Information (page 3)
Page 3 of 4 — CVEs classified under CWE-451, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2316 | Medium | 6.5 | 2026-02-11 | Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-21527 | Medium | 6.5 | 2026-02-10 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-0391 | Medium | 6.5 | 2026-02-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20732 | Low | 3.1 | 2026-02-04 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which h… |
CVE-2026-0907 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-0906 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2026-0904 | Medium | 5.4 | 2026-01-20 | Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2026-0901 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2025-62224 | Medium | 5.5 | 2026-01-07 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network. |
CVE-2025-65046 | Low | 3.1 | 2025-12-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-14744 | Medium | 6.5 | 2025-12-18 | Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files… |
CVE-2025-14023 | Low | 3.1 | 2025-12-15 | LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could… |
CVE-2025-14021 | Medium | 4.3 | 2025-12-15 | The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaS… |
CVE-2025-14020 | Medium | 5.4 | 2025-12-15 | LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is… |
CVE-2025-14019 | Low | 3.4 | 2025-12-15 | LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen war… |
CVE-2025-46287 | Medium | 6.5 | 2025-12-12 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2025-64667 | Medium | 5.3 | 2025-12-09 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-62223 | Medium | 4.3 | 2025-12-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-31266 | Medium | 4.3 | 2025-11-21 | A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5… |
CVE-2025-13082 | Medium | 4.3 | 2025-11-18 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from… |
CVE-2025-13107 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-13102 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a craft… |
CVE-2024-7021 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2024-13178 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (C… |
CVE-2024-11919 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2025-12729 | Medium | 4.2 | 2025-11-10 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-12728 | Medium | 4.2 | 2025-11-10 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-12446 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2025-12435 | Medium | 5.4 | 2025-11-10 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12911 | Medium | 4.3 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-11213 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-11212 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2025-11208 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2025-11720 | High | 8.1 | 2025-10-14 | The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted… |
CVE-2025-11718 | Medium | 6.5 | 2025-10-14 | When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychang… |
CVE-2024-6429 | Medium | 4.3 | 2025-09-23 | A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed t… |
CVE-2025-10290 | Medium | 6.5 | 2025-09-16 | Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers t… |
CVE-2025-43327 | Medium | 6.5 | 2025-09-15 | The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead to address bar spoo… |
CVE-2025-9867 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-9865 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-9491 | High | 7.8 | 2025-08-26 | Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2025-9186 | Medium | 6.5 | 2025-08-19 | Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142. |
CVE-2025-9183 | Medium | 6.5 | 2025-08-19 | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2. |
CVE-2025-8364 | Medium | 4.3 | 2025-08-19 | A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Androi… |
CVE-2025-8041 | Medium | 5.3 | 2025-08-19 | In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox… |
CVE-2025-49755 | Medium | 4.3 | 2025-08-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-8583 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-43228 | Medium | 4.3 | 2025-07-30 | The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar sp… |
CVE-2025-43712 | Low | 2.9 | 2025-07-25 | JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard… |
CVE-2025-8043 | Critical | 9.8 | 2025-07-22 | Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141. |
CVE-2025-47964 | Medium | 5.4 | 2025-07-11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-47963 | Medium | 6.3 | 2025-07-11 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-7021 | Medium | 6.5 | 2025-07-10 | Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture… |
CVE-2024-39730 | Medium | 5.4 | 2025-06-28 | IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2025-5986 | Medium | 6.5 | 2025-06-11 | A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompti… |
CVE-2025-5066 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-5065 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2024-9163 | Low | 3.5 | 2025-05-23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an att… |
CVE-2025-29825 | Medium | 6.5 | 2025-05-02 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-3859 | Medium | 6.1 | 2025-04-30 | Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into… |
CVE-2025-4086 | Medium | 6.5 | 2025-04-29 | A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. … |
CVE-2025-46394 | Low | 3.2 | 2025-04-23 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. |
CVE-2025-3523 | Medium | 6.4 | 2025-04-15 | When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering ove… |
CVE-2025-32371 | Medium | 4.3 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to… |
CVE-2025-29796 | Medium | 4.7 | 2025-04-04 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-3074 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-3073 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-3072 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-30467 | Medium | 4.3 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. Visiting a malici… |
CVE-2024-54558 | Low | 2.8 | 2025-03-10 | A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be abl… |
CVE-2025-1922 | Medium | 4.3 | 2025-03-05 | Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specif… |
CVE-2025-21259 | Medium | 5.3 | 2025-02-11 | Microsoft Outlook Spoofing Vulnerability |
CVE-2025-21404 | Medium | 4.3 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-21253 | Medium | 5.3 | 2025-02-06 | Microsoft Edge for IOS and Android Spoofing Vulnerability |
CVE-2025-0451 | Medium | 6.3 | 2025-02-04 | Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2025-0729 | Medium | 4.3 | 2025-01-27 | A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. T… |
CVE-2025-21262 | Medium | 5.4 | 2025-01-24 | User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-0446 | Medium | 4.3 | 2025-01-15 | Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-0435 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-21314 | Medium | 6.5 | 2025-01-14 | Windows SmartScreen Spoofing Vulnerability |
CVE-2024-55896 | Medium | 5.4 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to ga… |
CVE-2020-9236 | High | 8.8 | 2024-12-27 | There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. A… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-52271 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flat… | |
CVE-2024-52270 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show… | |
CVE-2024-52269 | High | 8.1 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content t… |
CVE-2024-52277 | | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flatt… | |
CVE-2024-52276 | High | 7.5 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer f… |
CVE-2024-49040 | High | 7.5 | 2024-11-12 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2024-51749 | Low | 3.5 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attach… |
CVE-2024-47044 | Medium | 5.3 | 2024-09-26 | Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for D… |
CVE-2024-7020 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2024-7019 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2023-7282 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2023-7281 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2024-8909 | Medium | 4.3 | 2024-09-17 | Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2024-43461 | High | 8.8 | 2024-09-10 | Windows MSHTML Platform Spoofing Vulnerability |
CVE-2024-38197 | Medium | 6.5 | 2024-08-13 | Microsoft Teams for iOS Spoofing Vulnerability |
CVE-2024-6999 | Medium | 4.3 | 2024-08-06 | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2024-7529 | Medium | 6.5 | 2024-08-06 | The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability… |