CWE-1007 · Input Validation and Logic
Insufficient Visual Distinction of Homoglyphs Presented to User
6CVEs
SortMost likely exploited
6 CVEs with CWE-1007 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-27611base-x homograph attack allows Unicode lookalike characters to bypass validation.cryptocoinjs · base-x · CVSS 8.7 · 2025-04-30 | 8.7 | 0.4% | 2025-04-30 |
| CVE-2021-4221If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. <br>*This bu…Mozilla · Firefox · CVSS 4.3 · 2022-12-22 | 4.3 | 0.4% | 2022-12-22 |
| CVE-2025-0996Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte…Google · Chrome · CVSS 5.4 · 2025-02-15 | 5.4 | 0.4% | 2025-02-15 |
| CVE-2026-48760Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defensesymfony · symfony · CVSS 5.3 · 2026-07-14 | 5.3 | 0.3% | 2026-07-14 |
| CVE-2026-45064Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofingsymfony · symfony · CVSS 2.3 · 2026-07-14 | 2.3 | 0.3% | 2026-07-14 |
| CVE-2026-126348Addressable display_uri can show misleading hosts with invalid Punycode A-labelssporkmonger · addressable · CVSS 4.3 · 2026-11-12 | 4.3 | 0.3% | 2026-11-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.