CWE-451 · Input Validation and Logic
User Interface (UI) Misrepresentation of Critical Information
496CVEs
2exploited
1with a public check
2likely (EPSS 10%+)
SortMost likely exploited
496 CVEs with CWE-451 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-38112In CISA KEVExploitedWindows MSHTML Platform Spoofing VulnerabilityMicrosoft · Windows 10 Version 22H2 · CVSS 7.5 · 2024-07-09 | 7.5 | 84% | 2024-07-09 |
| CVE-2024-43461In CISA KEVExploitedWindows MSHTML Platform Spoofing VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 8.8 · 2024-09-10 | 8.8 | 54% | 2024-09-10 |
| CVE-2022-39258CheckMailcow Dockerized Swagger UI - Cross-Site Scriptingmailcow · mailcow-dockerized · CVSS 8.1 · 2022-09-27 | 8.1 | 1.8% | 2022-09-27 |
| CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityMicrosoft · Windows · CVSS 3.3 · 2025-08-26 | 3.3 | 76% | 2025-08-26 |
| CVE-2024-38197Microsoft Teams for iOS Spoofing VulnerabilityMicrosoft · Microsoft Teams for iOS · CVSS 6.5 · 2024-08-13 | 6.5 | 17% | 2024-08-13 |
| CVE-2026-0907Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity:…Google · Chrome · CVSS 9.8 · 2026-01-20 | 9.8 | 8.8% | 2026-01-20 |
| CVE-2024-49040Microsoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server 2019 Cumulative Update 13 · CVSS 7.5 · 2024-11-12 | 7.5 | 8.5% | 2024-11-12 |
| CVE-2022-32816The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a website that frames mal…Apple · macOS · CVSS 6.5 · 2022-09-23 | 6.5 | 8.2% | 2022-09-23 |
| CVE-2026-21527Microsoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 6.5 · 2026-02-10 | 6.5 | 8.1% | 2026-02-10 |
| CVE-2016-9467Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifyi…Nextcloud · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 &… · 2017-03-28 | – | 3.0% | 2017-03-28 |
| CVE-2024-55889phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Framesthorsten · phpMyFAQ · CVSS 4.9 · 2024-12-13 | 4.9 | 2.2% | 2024-12-13 |
| CVE-2016-9468Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoint…Nextcloud · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 &… · 2017-03-28 | – | 2.1% | 2017-03-28 |
| CVE-2016-9473Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious…Brave · Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56… · 2017-03-28 | – | 1.9% | 2017-03-28 |
| CVE-2020-10775An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing a…Redhat · ovirt-engine · 2020-08-24 | – | 1.8% | 2020-08-24 |
| CVE-2022-23646Improper CSP in Image Optimization API for Next.jsvercel · next.js · CVSS 5.9 · 2022-02-17 | 5.9 | 1.8% | 2022-02-17 |
| CVE-2016-9460Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the…Nextcloud · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Se… · 2017-03-28 | – | 1.7% | 2017-03-28 |
| CVE-2017-0888Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially…Nextcloud · Nextcloud Server · 2017-04-05 | – | 1.5% | 2017-04-05 |
| CVE-2025-21314Windows SmartScreen Spoofing VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 6.5 · 2025-01-14 | 6.5 | 1.4% | 2025-01-14 |
| CVE-2025-21253Microsoft Edge for IOS and Android Spoofing VulnerabilityMicrosoft · Microsoft Edge for Android · CVSS 5.3 · 2025-02-06 | 5.3 | 1.2% | 2025-02-06 |
| CVE-2025-21259Microsoft Outlook Spoofing VulnerabilityMicrosoft · Microsoft Outlook for Android · CVSS 5.3 · 2025-02-11 | 5.3 | 1.2% | 2025-02-11 |
| CVE-2021-41598UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to userGitHub · GitHub Enterprise Server · 2022-01-25 | – | 1.2% | 2022-01-25 |
| CVE-2021-22866UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resourcesGitHub · GitHub Enterprise Server · 2021-05-14 | – | 1.0% | 2021-05-14 |
| CVE-2020-7371Raise IT Solutions RITS Browser Address Bar SpooofingRaise IT Solutions · RITS Browser · CVSS 4.3 · 2020-10-20 | 4.3 | 1.0% | 2020-10-20 |
| CVE-2020-7370Danyil Vasilenko Bolt Browser Address Bar SpooofingDanyil Vasilenko · Bolt Browser · CVSS 4.3 · 2020-10-20 | 4.3 | 1.0% | 2020-10-20 |
| CVE-2020-7369Yandex Browser Address Bar SpooofingYandex · Yandex Browser · CVSS 4.3 · 2020-10-20 | 4.3 | 1.0% | 2020-10-20 |
| CVE-2025-43228The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.Apple · Safari · CVSS 4.3 · 2025-07-29 | 4.3 | 0.9% | 2025-07-29 |
| CVE-2024-4950Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI sp…Google · Chrome · CVSS 5.3 · 2024-05-15 | 5.3 | 0.9% | 2024-05-15 |
| CVE-2023-2938Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents…Google · Chrome · CVSS 4.3 · 2023-05-30 | 4.3 | 0.9% | 2023-05-30 |
| CVE-2023-2937Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents…Google · Chrome · CVSS 4.3 · 2023-05-30 | 4.3 | 0.9% | 2023-05-30 |
| CVE-2025-29825Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 6.5 · 2025-05-02 | 6.5 | 0.9% | 2025-05-02 |
| CVE-2025-64667Microsoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 5.3 · 2025-12-09 | 5.3 | 0.8% | 2025-12-09 |
| CVE-2024-0750A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Fir…Mozilla · Firefox · CVSS 8.8 · 2024-01-23 | 8.8 | 0.8% | 2024-01-23 |
| CVE-2026-114171Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft · Visual Studio Code · CVSS 8.8 · 2026-11-10 | 8.8 | 0.8% | 2026-11-10 |
| CVE-2022-34479A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attac…Mozilla · Firefox · CVSS 6.5 · 2022-12-22 | 6.5 | 0.8% | 2022-12-22 |
| CVE-2022-3313Incorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: M…Google · Chrome · CVSS 6.5 · 2022-11-01 | 6.5 | 0.8% | 2022-11-01 |
| CVE-2020-7364UCWeb UC Browser Address Bar SpooofingUCWeb · UC Browser · CVSS 4.3 · 2020-10-20 | 4.3 | 0.7% | 2020-10-20 |
| CVE-2020-7363UCWeb UC Browser Address Bar SpooofingUCWeb · UC Browser · CVSS 4.3 · 2020-10-20 | 4.3 | 0.7% | 2020-10-20 |
| CVE-2023-0700Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted…Google · Chrome · CVSS 6.5 · 2023-02-07 | 6.5 | 0.7% | 2023-02-07 |
| CVE-2022-26383When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and…Mozilla · Firefox · CVSS 4.3 · 2022-12-22 | 4.3 | 0.7% | 2022-12-22 |
| CVE-2024-2631Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity:…Google · Chrome · CVSS 4.3 · 2024-03-20 | 4.3 | 0.7% | 2024-03-20 |
| CVE-2021-33593Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.NAVER · NAVER Whale browser · 2021-11-02 | – | 0.7% | 2021-11-02 |
| CVE-2022-38163A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on address bar could lead t…F-Secure · Safe · CVSS 3.5 · 2022-11-07 | 3.5 | 0.7% | 2022-11-07 |
| CVE-2022-45404Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in pote…Mozilla · Firefox ESR · CVSS 6.5 · 2022-12-22 | 6.5 | 0.7% | 2022-12-22 |
| CVE-2022-2800SourceCodester Gym Management System clickjackingSourceCodester · Gym Management System · CVSS 4.3 · 2022-08-12 | 4.3 | 0.6% | 2022-08-12 |
| CVE-2026-0391Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 6.5 · 2026-02-05 | 6.5 | 0.6% | 2026-02-05 |
| CVE-2024-30055Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 5.4 · 2024-05-10 | 5.4 | 0.6% | 2024-05-10 |
| CVE-2023-2941Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to spoof the conte…Google · Chrome · CVSS 4.3 · 2023-05-30 | 4.3 | 0.6% | 2023-05-30 |
| CVE-2025-47963Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 6.3 · 2025-07-11 | 6.3 | 0.6% | 2025-07-11 |
| CVE-2026-45650Microsoft Bing Search Spoofing VulnerabilityMicrosoft · Microsoft Bing Search for Android · CVSS 4.3 · 2026-06-09 | 4.3 | 0.6% | 2026-06-09 |
| CVE-2025-29796Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft · Microsoft Edge for iOS · CVSS 4.7 · 2025-04-04 | 4.7 | 0.6% | 2025-04-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.