CWE-1007
7 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 7Published CVEs7 of them scored
- 4Last 12 monthspublished in the last year
- 0Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126349
Addressable display_uri can show misleading hosts containing bidi and invisible characters
sporkmonger · addressable
Low3.1 - CVE-2026-126348
Addressable display_uri can show misleading hosts with invalid Punycode A-labels
sporkmonger · addressable
Medium4.3 - CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
symfony · symfony
Medium5.3 - CVE-2026-45064
Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
symfony · symfony
Low2.3 - CVE-2025-27611
base-x homograph attack allows Unicode lookalike characters to bypass validation.
cryptocoinjs · base-x
High8.7 - CVE-2025-0996
Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox…
Google · Chrome
Medium5.4 - CVE-2021-4221
If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing…
Mozilla · Firefox
Medium4.3