Skip to content

CWE-449 · weakness in Input Validation and Logic

The UI Performs the Wrong Action

14 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

  1. Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.CVE-2023-36535Zoom Video Communications, Inc. · CVSS 7.1 · 1.2% likely

    Zoom Video Communications, Inc.

  2. Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.CVE-2023-39215Zoom Video Communications, Inc. · CVSS 7.1 · 1.1% likely

    Zoom Video Communications, Inc.

  3. Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-21404Microsoft · CVSS 4.3 · 1.1% likely

    Microsoft

  4. Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-49041Microsoft · CVSS 4.3 · 1.0% likely

    Microsoft

  5. Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access.CVE-2023-39209Zoom Video Communications, Inc. · CVSS 5.9 · 1.0% likely

    Zoom Video Communications, Inc.

  6. Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-26643Microsoft · CVSS 5.4 · 0.7% likely

    Microsoft

  7. Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.CVE-2023-43588Zoom Video Communications, Inc. · CVSS 3.5 · 0.7% likely

    Zoom Video Communications, Inc.

  8. Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityCVE-2025-49736Microsoft · CVSS 4.3 · 0.6% likely

    Microsoft

  9. Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network a…CVE-2023-43585Zoom Video Communications, Inc. · CVSS 7.1 · 0.6% likely

    Zoom Video Communications, Inc.

  10. Zoom Clients - Improper AuthenticationCVE-2024-24698Zoom Video Communications, Inc. · CVSS 4.9 · 0.5% likely

    Zoom Video Communications, Inc.

  11. Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-38083Microsoft · CVSS 4.3 · 0.5% likely

    Microsoft

  12. Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-43577Microsoft · CVSS 4.3 · 0.5% likely

    Microsoft

  13. LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or com…CVE-2025-56139Linkedin · CVSS 5.3 · 0.3% likely
  14. Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass downlo…CVE-2025-13637Google · CVSS 4.3 · 0.3% likely

    Google

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in