CWE-449 · weakness in Input Validation and Logic
The UI Performs the Wrong Action
14 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.
- Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.
- Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.
- Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access.
- Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.
- Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network a…
- Zoom Clients - Improper Authentication
- Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based) Spoofing Vulnerability
- LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or com…
- Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass downlo…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.