Skip to content
BackEsc
Sign in

CWE-451 · weakness in Input Validation and Logic

User Interface (UI) Misrepresentation of Critical Information

496 CVEs · 2 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
check available
1
likely to be exploited
2

Every one of the 496 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-38112Microsoft · CVSS 7.5 · 84% likely

    Microsoft

  2. Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43461Microsoft · CVSS 8.8 · 54% likely

    Microsoft

  3. Mailcow Dockerized Swagger UI - Cross-Site ScriptingCVE-2022-39258mailcow · CVSS 8.1 · 1.8% likely

    Mailcow

  4. Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityCVE-2025-9491Microsoft · CVSS 3.3 · 76% likely

    Microsoft

  5. Microsoft Teams for iOS Spoofing VulnerabilityCVE-2024-38197Microsoft · CVSS 6.5 · 17% likely

    Microsoft

  6. Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity:…CVE-2026-0907Google · CVSS 9.8 · 8.8% likely

    Google

  7. Microsoft Exchange Server Spoofing VulnerabilityCVE-2024-49040Microsoft · CVSS 7.5 · 8.5% likely

    Microsoft

  8. The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a website that frames mal…CVE-2022-32816Apple · CVSS 6.5 · 8.2% likely

    Apple

  9. Microsoft Exchange Server Spoofing VulnerabilityCVE-2026-21527Microsoft · CVSS 6.5 · 8.1% likely

    Microsoft

  10. Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifyi…CVE-2016-9467Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 &… · 3.0% likely
  11. phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded FramesCVE-2024-55889thorsten · CVSS 4.9 · 2.2% likely

    Thorsten

  12. Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoint…CVE-2016-9468Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 &… · 2.1% likely
  13. Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious…CVE-2016-9473Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56… · 1.9% likely
  14. An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing a…CVE-2020-10775ovirt-engine · 1.8% likely
  15. Improper CSP in Image Optimization API for Next.jsCVE-2022-23646vercel · CVSS 5.9 · 1.8% likely

    Vercel

  16. Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the…CVE-2016-9460Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Se… · 1.7% likely
  17. Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially…CVE-2017-0888Nextcloud · 1.5% likely

    Nextcloud

  18. Windows SmartScreen Spoofing VulnerabilityCVE-2025-21314Microsoft · CVSS 6.5 · 1.4% likely

    Microsoft

  19. Microsoft Edge for IOS and Android Spoofing VulnerabilityCVE-2025-21253Microsoft · CVSS 5.3 · 1.2% likely

    Microsoft

  20. Microsoft Outlook Spoofing VulnerabilityCVE-2025-21259Microsoft · CVSS 5.3 · 1.2% likely

    Microsoft

  21. UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to userCVE-2021-41598GitHub · 1.2% likely

    GitHub

  22. UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resourcesCVE-2021-22866GitHub · 1.0% likely

    GitHub

  23. Raise IT Solutions RITS Browser Address Bar SpooofingCVE-2020-7371Raise IT Solutions · CVSS 4.3 · 1.0% likely
  24. Danyil Vasilenko Bolt Browser Address Bar SpooofingCVE-2020-7370Danyil Vasilenko · CVSS 4.3 · 1.0% likely
  25. Yandex Browser Address Bar SpooofingCVE-2020-7369Yandex · CVSS 4.3 · 1.0% likely

    Yandex

  26. The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.CVE-2025-43228Apple · CVSS 4.3 · 0.9% likely

    Apple

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in