# CWE-357.

Every Advisory and CVE whose sources give the weakness CWE-357, newest first.

## Records, newest first

- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was…](https://agentprime.io/advisories/CVE-2026-123839.md)
  `CVE-2026-123839` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.7 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-357
- [JetBrains Toolbox App: In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed…](https://agentprime.io/advisories/CVE-2026-123320.md)
  `CVE-2026-123320` · CVE record: JetBrains Toolbox App · CVSS 3.1 Low · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-58597.md)
  `CVE-2026-58597` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-357
- [Siber Systems, Inc. Android App "RoboForm Password Manager": Android App "RoboForm Password Manager" provided by Siber Systems…](https://agentprime.io/advisories/CVE-2026-47782.md)
  `CVE-2026-47782` · CVE record: Siber Systems, Inc. Android App "RoboForm Password Manager" · CVSS 4.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-357
- [Remote Desktop Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-26151.md)
  `CVE-2026-26151` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.1 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2025-47967.md)
  `CVE-2025-47967` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.7 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-357
- [Remote Desktop Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2025-33054.md)
  `CVE-2025-33054` · CVE record: Microsoft Windows 11 version 22H2 and 4 more · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-357
- [XWiki does not require right warnings for XClass definitions](https://agentprime.io/advisories/GHSA-59w6-r9hm-439h.md)
  `GHSA-59w6-r9hm-439h`, `CVE-2025-49585` · Maven `org.xwiki.platform:xwiki-platform-security-requiredrights-default`: affected `<15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 8.6 High · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-357
- [XWiki does not require right warnings for notification displayer objects](https://agentprime.io/advisories/GHSA-j7p2-87q3-44w7.md)
  `GHSA-j7p2-87q3-44w7`, `CVE-2025-49587` · Maven `org.xwiki.platform:xwiki-platform-notifications-notifiers-default`: affected `>=15.9-rc-1, <15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 6.4 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-357
- [XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right](https://agentprime.io/advisories/GHSA-ff6v-w58f-v97w.md)
  `GHSA-ff6v-w58f-v97w`, `CVE-2025-49583` · Maven `org.xwiki.platform:xwiki-platform-notifications-notifiers-default`: affected `<15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 5.1 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Privilege escalation, CWE-357
- [XWiki's required right warnings for macros are incomplete](https://agentprime.io/advisories/GHSA-c32m-27pj-4xcj.md)
  `GHSA-c32m-27pj-4xcj`, `CVE-2025-49582` · Maven `org.xwiki.platform:xwiki-platform-rendering-macro-cache` and 3 more: affected `>=15.9-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0`, fixed in `16.4.7`, `16.10.3`, `17.0.0` · CVSS 8.6 High · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-49054.md)
  `CVE-2024-49054` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-43580.md)
  `CVE-2024-43580` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 5.4 Medium · Not analysed yet · Published 17 Oct 2024 · Tags: CWE-357
- [Microsoft Office Visio Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-43505.md)
  `CVE-2024-43505` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 3 more · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-30058.md)
  `CVE-2024-30058` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 5.4 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: Authentication bypass, CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-29057.md)
  `CVE-2024-29057` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 22 Mar 2024 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-26188.md)
  `CVE-2024-26188` · CVE record: Microsoft Microsoft Edge for Android · CVSS 4.3 Medium · Not analysed yet · Published 23 Feb 2024 · Tags: CWE-357
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-21336.md)
  `CVE-2024-21336` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 2.5 Low · Not analysed yet · Published 26 Jan 2024 · Tags: CWE-357
- [Microsoft Edge for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-21387.md)
  `CVE-2024-21387` · CVE record: Microsoft Microsoft Edge (Chromium-based) and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 26 Jan 2024 · Tags: CWE-357
- [Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions](https://agentprime.io/advisories/CVE-2022-41904.md)
  `CVE-2022-41904` · CVE record: vector-im element-ios · CVSS 6.4 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-357
- [Luxion KeyShot: Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1…](https://agentprime.io/advisories/CVE-2021-22645.md)
  `CVE-2021-22645` · CVE record: Luxion KeyShot and 3 more · No CVSS score · Not analysed yet · Published 23 Feb 2021 · Tags: CWE-357
- [Rockwell Automation Arena Simulation Software: A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation…](https://agentprime.io/advisories/CVE-2019-13521.md)
  `CVE-2019-13521` · CVE record: Rockwell Rockwell Automation Arena Simulation Software · No CVSS score · Not analysed yet · Published 27 Jan 2020 · Tags: CWE-357

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-357>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-357/>. Everything for agents: <https://agentprime.io/llms.txt>.