# CWE-451. Every Advisory and CVE whose sources give the weakness CWE-451, newest first. ## Records, newest first (an older page) - [Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing](https://agentprime.io/advisories/GHSA-h5vq-qfcg-4m6p.md) `GHSA-h5vq-qfcg-4m6p`, `CVE-2026-45064`, `PKSA-4fc7-y875-17k3`, `PKSA-t5z9-jvfg-zqhb` · Packagist `symfony/html-sanitizer` and 1 more: affected `>=6.1.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `6.4.40`, `7.4.12`, `8.0.12` · CVSS 2.3 Low · Not analysed yet · Published 27 May 2026 · Tags: CWE-451, CWE-1007 - [PuTTY: PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET…](https://agentprime.io/advisories/CVE-2026-48851.md) `CVE-2026-48851` · CVE record: PuTTY PuTTY · CVSS 3.1 Low · Not analysed yet · Published 25 May 2026 · Tags: CWE-451 - [Firefox iOS RTL Domain Rendering Issue in Link Preview](https://agentprime.io/advisories/CVE-2026-9078.md) `CVE-2026-9078` · CVE record: Mozilla Firefox for iOS · CVSS 5.4 Medium · Not analysed yet · Published 25 May 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179…](https://agentprime.io/advisories/CVE-2026-9110.md) `CVE-2026-9110` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-451 - [Trilium Notes: macOS TCC Bypass via Prompt Spoofing](https://agentprime.io/advisories/CVE-2026-39309.md) `CVE-2026-39309` · CVE record: TriliumNext Trilium · CVSS 5.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass, CWE-451 - [Spoofing issue in the Popup Blocker component](https://agentprime.io/advisories/CVE-2026-8964.md) `CVE-2026-8964` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168…](https://agentprime.io/advisories/CVE-2026-8584.md) `CVE-2026-8584` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168…](https://agentprime.io/advisories/CVE-2026-8565.md) `CVE-2026-8565` · CVE record: Google Chrome · CVSS 4.7 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to…](https://agentprime.io/advisories/CVE-2026-8564.md) `CVE-2026-8564` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a…](https://agentprime.io/advisories/CVE-2026-8561.md) `CVE-2026-8561` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-451 - [An inconsistent user interface issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2025-46311.md) `CVE-2025-46311` · CVE record: Apple iOS and iPadOS · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-451 - [Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-40416.md) `CVE-2026-40416` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-451 - [Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-35429.md) `CVE-2026-35429` · CVE record: Microsoft Microsoft Edge for Android · CVSS 4.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-451 - [Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-42891.md) `CVE-2026-42891` · CVE record: Microsoft Microsoft Edge for Android · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-451 - [Content Spoofing vulnerability in SAPUI5 (Search UI)](https://agentprime.io/advisories/CVE-2026-34258.md) `CVE-2026-34258` · CVE record: SAP_SE SAPUI5 (Search UI) · CVSS 4.7 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-451 - [An inconsistent user interface issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2026-28964.md) `CVE-2026-28964` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-451 - [Zen Browser Mac - Address Bar Spoofing via Long Subdomain](https://agentprime.io/advisories/CVE-2026-44659.md) `CVE-2026-44659` · CVE record: zen-browser desktop · CVSS 4.7 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-451 - [Google Chrome: Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed…](https://agentprime.io/advisories/CVE-2026-8019.md) `CVE-2026-8019` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a…](https://agentprime.io/advisories/CVE-2026-8015.md) `CVE-2026-8015` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed…](https://agentprime.io/advisories/CVE-2026-8008.md) `CVE-2026-8008` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-451 - [Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96…](https://agentprime.io/advisories/CVE-2026-8006.md) `CVE-2026-8006` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a…](https://agentprime.io/advisories/CVE-2026-7935.md) `CVE-2026-7935` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-451 - [HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability](https://agentprime.io/advisories/CVE-2025-31951.md) `CVE-2025-31951` · CVE record: HCL BigFix RunBookAI · CVSS 8.8 High · Not analysed yet · Published 6 May 2026 · Tags: Command injection, CWE-351, CWE-451 - [Duplicate Advisory: uutils coreutils's User Interface (UI) Misrepresents Critical Information](https://agentprime.io/advisories/GHSA-53gr-wmf4-8hh3.md) `GHSA-53gr-wmf4-8hh3` · crates.io `coreutils`: affected `<=0.8.0`, no fixed version yet · CVSS 3.3 Low · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-451 - [LY Corporation LINE client for iOS: LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app…](https://agentprime.io/advisories/CVE-2026-3861.md) `CVE-2026-3861` · CVE record: LY Corporation LINE client for iOS · CVSS 7.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-451 - [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-33118.md) `CVE-2026-33118` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-451 - [Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-33119.md) `CVE-2026-33119` · CVE record: Microsoft Microsoft Edge for Android · CVSS 5.4 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55…](https://agentprime.io/advisories/CVE-2026-5906.md) `CVE-2026-5906` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55…](https://agentprime.io/advisories/CVE-2026-5905.md) `CVE-2026-5905` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a…](https://agentprime.io/advisories/CVE-2026-5898.md) `CVE-2026-5898` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a…](https://agentprime.io/advisories/CVE-2026-5897.md) `CVE-2026-5897` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a…](https://agentprime.io/advisories/CVE-2026-5895.md) `CVE-2026-5895` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55…](https://agentprime.io/advisories/CVE-2026-5891.md) `CVE-2026-5891` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a…](https://agentprime.io/advisories/CVE-2026-5882.md) `CVE-2026-5882` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55…](https://agentprime.io/advisories/CVE-2026-5880.md) `CVE-2026-5880` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote…](https://agentprime.io/advisories/CVE-2026-5878.md) `CVE-2026-5878` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-451 - [Duplicate Advisory: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv](https://agentprime.io/advisories/GHSA-w8rf-7qf8-65ww.md) `GHSA-w8rf-7qf8-65ww` · npm `openclaw`: affected `<2026.3.11`, fixed in `2026.3.11` · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-451 - [Spoofing issue in Thunderbird](https://agentprime.io/advisories/CVE-2026-3889.md) `CVE-2026-3889` · CVE record: Mozilla Thunderbird · CVSS 6.5 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-451 - [Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32317.md) `CVE-2026-32317` · CVE record: cryptomator android · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923 - [Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32318.md) `CVE-2026-32318` · CVE record: cryptomator ios · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923 - [Cryptomator: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32303.md) `CVE-2026-32303` · CVE record: cryptomator cryptomator · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923 - [Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-0385.md) `CVE-2026-0385` · CVE record: Microsoft Microsoft Edge for Android · CVSS 5.0 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Authentication bypass, CWE-451 - [OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv](https://agentprime.io/advisories/GHSA-rw39-5899-8mxp.md) `GHSA-rw39-5899-8mxp`, `CVE-2026-32971` · npm `openclaw`: affected `<2026.3.11`, fixed in `2026.3.11` · CVSS 7.3 High · Not analysed yet · Published 13 Mar 2026 · Tags: Broken access control, CWE-436, CWE-451 - [Google Chrome: Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed…](https://agentprime.io/advisories/CVE-2026-3942.md) `CVE-2026-3942` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71…](https://agentprime.io/advisories/CVE-2026-3937.md) `CVE-2026-3937` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a…](https://agentprime.io/advisories/CVE-2026-3935.md) `CVE-2026-3935` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-451 - [Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71…](https://agentprime.io/advisories/CVE-2026-3928.md) `CVE-2026-3928` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed…](https://agentprime.io/advisories/CVE-2026-3927.md) `CVE-2026-3927` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-451 - [Google Chrome: Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to…](https://agentprime.io/advisories/CVE-2026-3925.md) `CVE-2026-3925` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-451 - [Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect](https://agentprime.io/advisories/CVE-2026-2919.md) `CVE-2026-2919` · CVE record: Mozilla Focus for iOS · CVSS 4.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-451 - [OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal](https://agentprime.io/advisories/CVE-2025-68277.md) `CVE-2025-68277` · CVE record: openemr openemr · CVSS 7.2 High · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-451 - [Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS](https://agentprime.io/advisories/CVE-2026-2634.md) `CVE-2026-2634` · CVE record: Mozilla Firefox for iOS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-451 - [Content spoofing vulnerability discovered in OpenText™ Directory Services](https://agentprime.io/advisories/CVE-2026-1658.md) `CVE-2026-1658` · CVE record: OpenText™ Directory Services · CVSS 5.3 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-451 - [OpenClaw macOS deep link confirmation truncation can conceal executed agent message](https://agentprime.io/advisories/GHSA-7q2j-c4q5-rm27.md) `GHSA-7q2j-c4q5-rm27`, `CVE-2026-26320` · npm `openclaw`: affected `>=2026.2.6-0, <2026.2.14`, fixed in `2026.2.14` · CVSS 7.1 High · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-451 - [Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS](https://agentprime.io/advisories/CVE-2026-2032.md) `CVE-2026-2032` · CVE record: Mozilla Firefox for iOS · CVSS 4.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed…](https://agentprime.io/advisories/CVE-2026-2323.md) `CVE-2026-2323` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45…](https://agentprime.io/advisories/CVE-2026-2322.md) `CVE-2026-2322` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45…](https://agentprime.io/advisories/CVE-2026-2320.md) `CVE-2026-2320` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-451 - [Google Chrome: Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45…](https://agentprime.io/advisories/CVE-2026-2318.md) `CVE-2026-2318` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-451 - [Google Chrome: Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed…](https://agentprime.io/advisories/CVE-2026-2316.md) `CVE-2026-2316` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-451 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .