Advisories · Weakness

CWE-451.

Every Advisory and CVE whose sources give the weakness CWE-451, newest first.

symfony/html-sanitizer +1 Packagist

CVSS 2.3 Low

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
- CWE-451
- CWE-1007
>=6.1.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12

GHSA-h5vq-qfcg-4m6p · CVE-2026-45064 Not analysed yet 27 May 2026
CVE-2026-48851 CVE record

CVSS 3.1 Low

PuTTY: PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET…
- PuTTY
- CWE-451
Not analysed yet 25 May 2026
CVE-2026-9078 CVE record

CVSS 5.4 Medium

Firefox iOS RTL Domain Rendering Issue in Link Preview
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 25 May 2026
CVE-2026-9110 CVE record

CVSS 4.2 Medium

Google Chrome: Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179…
- Google Chrome
- CWE-451
Not analysed yet 20 May 2026
CVE-2026-39309 CVE record

CVSS 5.5 Medium

Trilium Notes: macOS TCC Bypass via Prompt Spoofing
- Trilium
- Authentication bypass
- CWE-451
Not analysed yet 19 May 2026
CVE-2026-8964 CVE record

CVSS 7.5 High

Spoofing issue in the Popup Blocker component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 19 May 2026
CVE-2026-8584 CVE record

CVSS 4.2 Medium

Google Chrome: Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168…
- Google Chrome
- CWE-451
Not analysed yet 14 May 2026
CVE-2026-8565 CVE record

CVSS 4.7 Medium

Google Chrome: Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168…
- Google Chrome
- CWE-451
Not analysed yet 14 May 2026
CVE-2026-8564 CVE record

CVSS 4.2 Medium

Google Chrome: Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to…
- Google Chrome
- CWE-451
Not analysed yet 14 May 2026
CVE-2026-8561 CVE record

CVSS 5.4 Medium

Google Chrome: Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 14 May 2026
CVE-2025-46311 CVE record

CVSS 7.5 High

An inconsistent user interface issue was addressed with improved state management.
- Apple iOS and iPadOS
- CWE-451
Not analysed yet 12 May 2026
CVE-2026-40416 CVE record

CVSS 4.3 Medium

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- CWE-451
Not analysed yet 12 May 2026
CVE-2026-35429 CVE record

CVSS 4.3 Medium

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- Microsoft Edge for Android
- CWE-451
Not analysed yet 12 May 2026
CVE-2026-42891 CVE record

CVSS 6.5 Medium

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- Microsoft Edge for Android
- CWE-451
Not analysed yet 12 May 2026
CVE-2026-34258 CVE record

CVSS 4.7 Medium

Content Spoofing vulnerability in SAPUI5 (Search UI)
- SAP_SE SAPUI5 (Search UI)
- CWE-451
Not analysed yet 12 May 2026
CVE-2026-28964 CVE record

CVSS 7.5 High

An inconsistent user interface issue was addressed with improved state management.
- Apple iOS and iPadOS
- Apple visionOS
- CWE-451
Not analysed yet 11 May 2026
CVE-2026-44659 CVE record

CVSS 4.7 Medium

Zen Browser Mac - Address Bar Spoofing via Long Subdomain
- zen-browser desktop
- CWE-451
Not analysed yet 11 May 2026
CVE-2026-8019 CVE record

CVSS 5.4 Medium

Google Chrome: Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed…
- Google Chrome
- CWE-451
Not analysed yet 6 May 2026
CVE-2026-8015 CVE record

CVSS 5.4 Medium

Google Chrome: Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 6 May 2026
CVE-2026-8008 CVE record

CVSS 5.4 Medium

Google Chrome: Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed…
- Google Chrome
- CWE-451
Not analysed yet 6 May 2026
CVE-2026-8006 CVE record

CVSS 5.4 Medium

Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96…
- Google Chrome
- CWE-451
Not analysed yet 6 May 2026
CVE-2026-7935 CVE record

CVSS 5.4 Medium

Google Chrome: Inappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 6 May 2026
CVE-2025-31951 CVE record

CVSS 8.8 High

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability
- HCL BigFix RunBookAI
- Command injection
- CWE-351
Not analysed yet 6 May 2026
coreutils crates.io

CVSS 3.3 Low

Duplicate Advisory: uutils coreutils's User Interface (UI) Misrepresents Critical Information
- CWE-451
<=0.8.0 · no fixed version yet

GHSA-53gr-wmf4-8hh3 Withdrawn Not analysed yet 22 Apr 2026
CVE-2026-3861 CVE record

CVSS 7.1 High

LY Corporation LINE client for iOS: LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app…
- LY Corporation LINE client for iOS
- CWE-451
Not analysed yet 16 Apr 2026
CVE-2026-33118 CVE record

CVSS 4.3 Medium

Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- CWE-451
Not analysed yet 10 Apr 2026
CVE-2026-33119 CVE record

CVSS 5.4 Medium

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- Microsoft Edge for Android
- CWE-451
Not analysed yet 10 Apr 2026
CVE-2026-5906 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5905 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5898 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5897 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5895 CVE record

CVSS 5.4 Medium

Google Chrome: Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5891 CVE record

CVSS 4.3 Medium

Google Chrome: Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5882 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5880 CVE record

CVSS 4.3 Medium

Google Chrome: Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
CVE-2026-5878 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote…
- Google Chrome
- CWE-451
Not analysed yet 8 Apr 2026
openclaw npm

CVSS 7.1 High

Duplicate Advisory: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
- CWE-451
<2026.3.11 · fixed in 2026.3.11

GHSA-w8rf-7qf8-65ww Withdrawn Not analysed yet 31 Mar 2026
CVE-2026-3889 CVE record

CVSS 6.5 Medium

Spoofing issue in Thunderbird
- Mozilla Thunderbird
- CWE-451
Not analysed yet 24 Mar 2026
CVE-2026-32317 CVE record

CVSS 7.6 High

Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API
- cryptomator android
- CWE-346
- CWE-354
Not analysed yet 20 Mar 2026
CVE-2026-32318 CVE record

CVSS 7.6 High

Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API
- cryptomator ios
- CWE-346
- CWE-354
Not analysed yet 20 Mar 2026
CVE-2026-32303 CVE record

CVSS 7.6 High

Cryptomator: Tampered vault configuration allows MITM attack on Hub API
- cryptomator
- CWE-346
- CWE-354
Not analysed yet 20 Mar 2026
CVE-2026-0385 CVE record

CVSS 5.0 Medium

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
- Microsoft Edge for Android
- Authentication bypass
- CWE-451
Not analysed yet 13 Mar 2026
openclaw npm

CVSS 7.3 High

OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
- Broken access control
- CWE-436
<2026.3.11 · fixed in 2026.3.11

GHSA-rw39-5899-8mxp · CVE-2026-32971 Not analysed yet 13 Mar 2026
CVE-2026-3942 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed…
- Google Chrome
- CWE-451
Not analysed yet 11 Mar 2026
CVE-2026-3937 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71…
- Google Chrome
- CWE-451
Not analysed yet 11 Mar 2026
CVE-2026-3935 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a…
- Google Chrome
- CWE-451
Not analysed yet 11 Mar 2026
CVE-2026-3928 CVE record

CVSS 4.3 Medium

Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71…
- Google Chrome
- CWE-451
Not analysed yet 11 Mar 2026
CVE-2026-3927 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed…
- Google Chrome
- CWE-451
Not analysed yet 11 Mar 2026
CVE-2026-3925 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to…
- Google Chrome
- CWE-451
Not analysed yet 11 Mar 2026
CVE-2026-2919 CVE record

CVSS 4.3 Medium

Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect
- Mozilla Focus for iOS
- CWE-451
Not analysed yet 9 Mar 2026
CVE-2025-68277 CVE record

CVSS 7.2 High

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
- openemr
- CWE-451
Not analysed yet 25 Feb 2026
CVE-2026-2634 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 24 Feb 2026
CVE-2026-1658 CVE record

CVSS 5.3 Medium

Content spoofing vulnerability discovered in OpenText™ Directory Services
- OpenText™ Directory Services
- CWE-451
Not analysed yet 19 Feb 2026
openclaw npm

CVSS 7.1 High

OpenClaw macOS deep link confirmation truncation can conceal executed agent message
- CWE-451
>=2026.2.6-0, <2026.2.14 · fixed in 2026.2.14

GHSA-7q2j-c4q5-rm27 · CVE-2026-26320 Not analysed yet 17 Feb 2026
CVE-2026-2032 CVE record

CVSS 4.3 Medium

Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 16 Feb 2026
CVE-2026-2323 CVE record

CVSS 4.3 Medium

Google Chrome: Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed…
- Google Chrome
- CWE-451
Not analysed yet 11 Feb 2026
CVE-2026-2322 CVE record

CVSS 5.4 Medium

Google Chrome: Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45…
- Google Chrome
- CWE-451
Not analysed yet 11 Feb 2026
CVE-2026-2320 CVE record

CVSS 6.5 Medium

Google Chrome: Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45…
- Google Chrome
- CWE-451
Not analysed yet 11 Feb 2026
CVE-2026-2318 CVE record

CVSS 6.5 Medium

Google Chrome: Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45…
- Google Chrome
- CWE-451
Not analysed yet 11 Feb 2026
CVE-2026-2316 CVE record

CVSS 6.5 Medium

Google Chrome: Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed…
- Google Chrome
- CWE-451
Not analysed yet 11 Feb 2026