CWE-451 · User Interface (UI) Misrepresentation of Critical Information (page 3)
Page 3 of 5 — CVEs classified under CWE-451, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48851 | Low | 3.1 | 2026-05-25 | PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and… |
CVE-2026-9078 | Medium | 5.4 | 2026-05-25 | Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RT… |
CVE-2026-9110 | Medium | 4.2 | 2026-05-20 | Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to pe… |
CVE-2026-39309 | Medium | 5.5 | 2026-05-20 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the… |
CVE-2026-8964 | High | 7.5 | 2026-05-19 | Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8584 | Medium | 4.2 | 2026-05-14 | Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-8565 | Medium | 4.7 | 2026-05-14 | Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2026-8564 | Medium | 4.2 | 2026-05-14 | Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted H… |
CVE-2026-8561 | Medium | 5.4 | 2026-05-14 | Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromiu… |
CVE-2026-42891 | Medium | 6.5 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-40416 | Medium | 4.3 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-35429 | Medium | 4.3 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-46311 | High | 7.5 | 2026-05-12 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2026-34258 | Medium | 4.7 | 2026-05-12 | SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitat… |
CVE-2026-28964 | High | 7.5 | 2026-05-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may b… |
CVE-2026-44659 | Medium | 4.7 | 2026-05-11 | Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controll… |
CVE-2026-8019 | Medium | 5.4 | 2026-05-06 | Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-8015 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2026-8008 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2026-8006 | Medium | 5.4 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-7935 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chrom… |
CVE-2025-31951 | High | 8.8 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identif… |
CVE-2026-35371 | Low | 3.3 | 2026-04-22 | The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation inco… |
CVE-2026-3861 | Medium | 6.5 | 2026-04-16 | LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level di… |
CVE-2026-33119 | Medium | 5.4 | 2026-04-10 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-33118 | Medium | 4.3 | 2026-04-10 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-5906 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2026-5905 | Medium | 6.5 | 2026-04-08 | Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML… |
CVE-2026-5898 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-5897 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-5895 | Medium | 5.4 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a… |
CVE-2026-5891 | Medium | 4.3 | 2026-04-08 | Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-5882 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-5880 | Medium | 4.3 | 2026-04-08 | Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spo… |
CVE-2026-5878 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secu… |
CVE-2026-32971 | High | 7.1 | 2026-03-31 | OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the… |
CVE-2026-3889 | Medium | 6.5 | 2026-03-24 | Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9. |
CVE-2026-32318 | High | 7.6 | 2026-03-20 | Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability a… |
CVE-2026-32317 | High | 7.6 | 2026-03-20 | Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerabil… |
CVE-2026-32303 | High | 7.6 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the… |
CVE-2026-0385 | Medium | 5.0 | 2026-03-16 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability |
CVE-2026-3942 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3937 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2026-3935 | Medium | 6.5 | 2026-03-11 | Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-3928 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-3927 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-3925 | Medium | 4.3 | 2026-03-11 | Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2026-2919 | Medium | 4.3 | 2026-03-09 | Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and tr… |
CVE-2025-68277 | Medium | 5.0 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure… |
CVE-2026-2634 | Critical | 9.8 | 2026-02-24 | Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-control… |
CVE-2026-26320 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unatten… |
CVE-2026-1658 | Medium | 5.3 | 2026-02-19 | User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. The vulnerability could b… |
CVE-2026-2032 | Medium | 4.3 | 2026-02-16 | Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof ar… |
CVE-2026-2323 | Medium | 4.3 | 2026-02-11 | Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2322 | Medium | 5.4 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2320 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2318 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2026-2316 | Medium | 6.5 | 2026-02-11 | Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-21527 | Medium | 6.5 | 2026-02-10 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-0391 | Medium | 6.5 | 2026-02-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20732 | Low | 3.1 | 2026-02-04 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which h… |
CVE-2026-0907 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-0906 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2026-0904 | Medium | 5.4 | 2026-01-20 | Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2026-0901 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2025-62224 | Medium | 5.5 | 2026-01-07 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network. |
CVE-2025-65046 | Low | 3.1 | 2025-12-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-14744 | Medium | 6.5 | 2025-12-18 | Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files… |
CVE-2025-14023 | Low | 3.1 | 2025-12-15 | LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could… |
CVE-2025-14021 | Medium | 4.3 | 2025-12-15 | The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaS… |
CVE-2025-14020 | Medium | 5.4 | 2025-12-15 | LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is… |
CVE-2025-14019 | Low | 3.4 | 2025-12-15 | LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen war… |
CVE-2025-46287 | Medium | 6.5 | 2025-12-12 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2025-64667 | Medium | 5.3 | 2025-12-09 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-62223 | Medium | 4.3 | 2025-12-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-31266 | Medium | 4.3 | 2025-11-21 | A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5… |
CVE-2025-13082 | Medium | 4.3 | 2025-11-18 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from… |
CVE-2025-13107 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-13102 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a craft… |
CVE-2024-7021 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2024-13178 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (C… |
CVE-2024-11919 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2025-12729 | Medium | 4.2 | 2025-11-10 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-12728 | Medium | 4.2 | 2025-11-10 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-12446 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2025-12435 | Medium | 5.4 | 2025-11-10 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12911 | Medium | 4.3 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-11213 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-11212 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2025-11208 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2025-11720 | High | 8.1 | 2025-10-14 | The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted… |
CVE-2025-11718 | Medium | 6.5 | 2025-10-14 | When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychang… |
CVE-2024-6429 | Medium | 4.3 | 2025-09-23 | A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed t… |
CVE-2025-10290 | Medium | 6.5 | 2025-09-16 | Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers t… |
CVE-2025-43327 | Medium | 6.5 | 2025-09-15 | The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead to address bar spoo… |
CVE-2025-9867 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-9865 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-9491 | High | 7.8 | 2025-08-26 | Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2025-9186 | Medium | 6.5 | 2025-08-19 | Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142. |
CVE-2025-9183 | Medium | 6.5 | 2025-08-19 | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2. |