CWE-356 · Access Control
Missing User Interaction for Potentially Unsafe Action
34CVEs
SortMost likely exploited
34 CVEs with CWE-356 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-124194In CISA KEVExploitedMicrosoft Outlook Spoofing VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 6.5 · 2026-11-10 | 6.5 | 1.6% | 2026-11-10 |
| CVE-2018-16858It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a documen…Libreoffice · libreoffice · CVSS 7.8 · 2019-03-25 | 7.8 | 67% | 2019-03-25 |
| CVE-2019-6737This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vu…Bitdefender · SafePay · CVSS 8.8 · 2019-06-03 | 8.8 | 3.8% | 2019-06-03 |
| CVE-2019-6738This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vu…Bitdefender · SafePay · CVSS 8.8 · 2019-06-03 | 8.8 | 3.7% | 2019-06-03 |
| CVE-2019-6736This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vu…Bitdefender · SafePay · CVSS 8.8 · 2019-06-03 | 8.8 | 3.7% | 2019-06-03 |
| CVE-2019-13322This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vu…Xiaomi · Browser · CVSS 7.5 · 2020-02-10 | 7.5 | 2.6% | 2020-02-10 |
| CVE-2019-17151This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required to explo…Tencent · WeChat · CVSS 4.3 · 2020-01-07 | 4.3 | 1.4% | 2020-01-07 |
| CVE-2025-31334Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.1…RARLAB · WinRAR · CVSS 6.8 · 2025-04-03 | 6.8 | 1.3% | 2025-04-03 |
| CVE-2022-39362Metabase vulnerable to arbitrary SQL execution from queryhashmetabase · metabase · CVSS 8.8 · 2022-10-26 | 8.8 | 1.0% | 2022-10-26 |
| CVE-2024-3044Graphic on-click binding allows unchecked script executionThe Document Foundation · LibreOffice · CVSS 6.5 · 2024-05-14 | 6.5 | 1.0% | 2024-05-14 |
| CVE-2022-35873This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required…Inductive Automation · Ignition · CVSS 7.8 · 2022-07-25 | 7.8 | 0.7% | 2022-07-25 |
| CVE-2026-119998Microsoft Office Security Feature Bypass VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 6.5 · 2026-11-10 | 6.5 | 0.7% | 2026-11-10 |
| CVE-2022-36970This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is re…AVEVA · Edge · CVSS 7.8 · 2023-03-29 | 7.8 | 0.7% | 2023-03-29 |
| CVE-2024-2609The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox…Mozilla · Firefox · CVSS 6.1 · 2024-03-19 | 6.1 | 0.6% | 2024-03-19 |
| CVE-2025-2450NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution VulnerabilityNI · Vision Builder AI · CVSS 7.8 · 2025-03-18 | 7.8 | 0.5% | 2025-03-18 |
| CVE-2025-3909JavaScript Execution via Spoofed PDF Attachment and file:/// LinkMozilla · Thunderbird · CVSS 8.1 · 2025-05-14 | 8.1 | 0.5% | 2025-05-14 |
| CVE-2024-30057Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft · Microsoft Edge for iOS · CVSS 5.4 · 2024-06-13 | 5.4 | 0.4% | 2024-06-13 |
| CVE-2018-10595A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+…Becton, Dickinson and Company · Kiestra and InoqulA systems · 2018-05-24 | – | 0.4% | 2018-05-24 |
| CVE-2025-3839Epiphany: insecure external protocol invocation in epiphanyNo vendor recorded · CVSS 8 · 2026-01-23 | 8.0 | 0.4% | 2026-01-23 |
| CVE-2026-0777Xmind Attachment Insufficient UI Warning Remote Code Execution VulnerabilityXmind · Xmind · CVSS 7.8 · 2026-02-20 | 7.8 | 0.4% | 2026-02-20 |
| CVE-2018-10593A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra…Becton, Dickinson and Company · Kiestra and InoqulA systems · 2018-05-24 | – | 0.4% | 2018-05-24 |
| CVE-2025-14403PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution VulnerabilityPDFsam · Enhanced · CVSS 7.8 · 2025-12-23 | 7.8 | 0.3% | 2025-12-23 |
| CVE-2026-25805Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.zed-industries · zed · CVSS 6.4 · 2026-02-10 | 6.4 | 0.3% | 2026-02-10 |
| CVE-2025-14404PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution VulnerabilityPDFsam · Enhanced · CVSS 7 · 2025-12-23 | 7.0 | 0.3% | 2025-12-23 |
| CVE-2025-14402PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution VulnerabilityPDFsam · Enhanced · CVSS 7 · 2025-12-23 | 7.0 | 0.3% | 2025-12-23 |
| CVE-2025-14415Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution VulnerabilitySoda PDF · Desktop · CVSS 7 · 2025-12-23 | 7.0 | 0.3% | 2025-12-23 |
| CVE-2024-4187Stored XSS vulnerability has been discovered in OpenText™ Filr. The vulnerability could cause users to not be warned when clicking links to external sites.OpenText™ · Filr · CVSS 2.1 · 2024-07-31 | 2.1 | 0.2% | 2024-07-31 |
| CVE-2025-58335In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 informatio…JetBrains · Junie · CVSS 5.5 · 2025-08-28 | 5.5 | 0.2% | 2025-08-28 |
| CVE-2025-14414Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution VulnerabilitySoda PDF · Desktop · CVSS 7.8 · 2025-12-23 | 7.8 | 0.2% | 2025-12-23 |
| CVE-2025-14417pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerabilitypdfforge · PDF Architect · CVSS 7.8 · 2025-12-23 | 7.8 | 0.2% | 2025-12-23 |
| CVE-2025-14412Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution VulnerabilitySoda PDF · Desktop · CVSS 7.8 · 2025-12-23 | 7.8 | 0.2% | 2025-12-23 |
| CVE-2025-14418pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerabilitypdfforge · PDF Architect · CVSS 7 · 2025-12-23 | 7.0 | 0.2% | 2025-12-23 |
| CVE-2025-14416pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerabilitypdfforge · PDF Architect · CVSS 7 · 2025-12-23 | 7.0 | 0.2% | 2025-12-23 |
| CVE-2026-28593In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no…Google · Android · CVSS 7.8 · 2026-09-08 | 7.8 | 0.1% | 2026-09-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.