# CWE-356. Every Advisory and CVE whose sources give the weakness CWE-356, newest first. ## Records, newest first - [In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI.](https://agentprime.io/advisories/CVE-2026-28593.md) `CVE-2026-28593` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-356 - [Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0777.md) `CVE-2026-0777` · CVE record: Xmind Xmind · CVSS 7.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-356 - [Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.](https://agentprime.io/advisories/CVE-2026-25805.md) `CVE-2026-25805` · CVE record: zed-industries zed · CVSS 6.4 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-356 - [Epiphany: insecure external protocol invocation in epiphany](https://agentprime.io/advisories/CVE-2025-3839.md) `CVE-2025-3839` · CVE record · CVSS 8.0 High · Not analysed yet · Published 23 Jan 2026 · Tags: CWE-356 - [Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14414.md) `CVE-2025-14414` · CVE record: Soda PDF Desktop · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14415.md) `CVE-2025-14415` · CVE record: Soda PDF Desktop · CVSS 7.0 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14412.md) `CVE-2025-14412` · CVE record: Soda PDF Desktop · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14418.md) `CVE-2025-14418` · CVE record: pdfforge PDF Architect · CVSS 7.0 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14417.md) `CVE-2025-14417` · CVE record: pdfforge PDF Architect · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14416.md) `CVE-2025-14416` · CVE record: pdfforge PDF Architect · CVSS 7.0 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14404.md) `CVE-2025-14404` · CVE record: PDFsam Enhanced · CVSS 7.0 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14403.md) `CVE-2025-14403` · CVE record: PDFsam Enhanced · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14402.md) `CVE-2025-14402` · CVE record: PDFsam Enhanced · CVSS 7.0 High · Not analysed yet · Published 23 Dec 2025 · Tags: CWE-356 - [JetBrains Junie: In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61…](https://agentprime.io/advisories/CVE-2025-58335.md) `CVE-2025-58335` · CVE record: JetBrains Junie · CVSS 5.5 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-356 - [Insufficient verification of data authenticity in Google Android](https://agentprime.io/advisories/CVE-2025-0092.md) `CVE-2025-0092` · CVE record: Google Android · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: CWE-345, CWE-356 - [JavaScript Execution via Spoofed PDF Attachment and file:/// Link](https://agentprime.io/advisories/CVE-2025-3909.md) `CVE-2025-3909` · CVE record: Mozilla Thunderbird · CVSS 8.1 High · Not analysed yet · Published 14 May 2025 · Tags: CWE-356 - [RARLAB WinRAR: Issue that bypasses the "Mark of the Web" security warning function for files when…](https://agentprime.io/advisories/CVE-2025-31334.md) `CVE-2025-31334` · CVE record: RARLAB WinRAR · CVSS 6.8 Medium · Not analysed yet · Published 3 Apr 2025 · Tags: CWE-356 - [NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-2450.md) `CVE-2025-2450` · CVE record: NI Vision Builder AI · CVSS 7.8 High · Not analysed yet · Published 18 Mar 2025 · Tags: CWE-356 - [Stored XSS vulnerability has been discovered in OpenText™ Filr. The vulnerability could cause users to not be warned when clicking links to external sites.](https://agentprime.io/advisories/CVE-2024-4187.md) `CVE-2024-4187` · CVE record: OpenText™ Filr · CVSS 2.1 Low · Not analysed yet · Published 31 Jul 2024 · Tags: CWE-356 - [Microsoft Edge for iOS Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-30057.md) `CVE-2024-30057` · CVE record: Microsoft Microsoft Edge for iOS · CVSS 5.4 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-356 - [Graphic on-click binding allows unchecked script execution](https://agentprime.io/advisories/CVE-2024-3044.md) `CVE-2024-3044` · CVE record: The Document Foundation LibreOffice · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2024 · Tags: Code injection, CWE-356 - [The permission prompt input delay could expire while the window is not in focus.](https://agentprime.io/advisories/CVE-2024-2609.md) `CVE-2024-2609` · CVE record: Mozilla Firefox and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-356 - [AVEVA Edge: This vulnerability allows remote attackers to execute arbitrary code on affected…](https://agentprime.io/advisories/CVE-2022-36970.md) `CVE-2022-36970` · CVE record: AVEVA Edge · CVSS 7.8 High · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-356 - [Metabase vulnerable to arbitrary SQL execution from queryhash](https://agentprime.io/advisories/CVE-2022-39362.md) `CVE-2022-39362` · CVE record: metabase metabase · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2022 · Tags: CWE-356 - [Inductive Automation Ignition: This vulnerability allows remote attackers to execute arbitrary code on affected…](https://agentprime.io/advisories/CVE-2022-35873.md) `CVE-2022-35873` · CVE record: Inductive Automation Ignition · CVSS 7.8 High · Not analysed yet · Published 25 Jul 2022 · Tags: CWE-356 - [Xiaomi Browser: This vulnerability allows remote attackers to execute arbitrary code on vulnerable…](https://agentprime.io/advisories/CVE-2019-13322.md) `CVE-2019-13322` · CVE record: Xiaomi Browser · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2020 · Tags: CWE-356 - [Tencent WeChat: This vulnerability allows remote attackers redirect users to an external resource on…](https://agentprime.io/advisories/CVE-2019-17151.md) `CVE-2019-17151` · CVE record: Tencent WeChat · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2020 · Tags: CWE-356 - [Bitdefender SafePay: This vulnerability allows remote attackers to execute arbitrary code on vulnerable…](https://agentprime.io/advisories/CVE-2019-6738.md) `CVE-2019-6738` · CVE record: Bitdefender SafePay · CVSS 8.8 High · Not analysed yet · Published 3 Jun 2019 · Tags: CWE-356 - [Bitdefender SafePay: This vulnerability allows remote attackers to execute arbitrary code on vulnerable…](https://agentprime.io/advisories/CVE-2019-6737.md) `CVE-2019-6737` · CVE record: Bitdefender SafePay · CVSS 8.8 High · Not analysed yet · Published 3 Jun 2019 · Tags: CWE-356 - [Bitdefender SafePay: This vulnerability allows remote attackers to execute arbitrary code on vulnerable…](https://agentprime.io/advisories/CVE-2019-6736.md) `CVE-2019-6736` · CVE record: Bitdefender SafePay · CVSS 8.8 High · Not analysed yet · Published 3 Jun 2019 · Tags: CWE-356 - [\[UNKNOWN\] libreoffice: It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a…](https://agentprime.io/advisories/CVE-2018-16858.md) `CVE-2018-16858` · CVE record: \[UNKNOWN\] libreoffice · CVSS 7.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.67 · Not analysed yet · Published 25 Mar 2019 · Tags: CWE-356 - [A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor)…](https://agentprime.io/advisories/CVE-2018-10595.md) `CVE-2018-10595` · CVE record: Becton, Dickinson and Company Kiestra and InoqulA systems · No CVSS score · Not analysed yet · Published 24 May 2018 · Tags: CWE-356 - [A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA,…](https://agentprime.io/advisories/CVE-2018-10593.md) `CVE-2018-10593` · CVE record: Becton, Dickinson and Company Kiestra and InoqulA systems · No CVSS score · Not analysed yet · Published 24 May 2018 · Tags: CWE-356 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .