The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.

What CVEs are caused by CWE-357?

18 recorded CVEs are attributed to CWE-357, including CVE-2025-49585, CVE-2025-49582, CVE-2025-33054.

What are the consequences of CWE-357?

Exploiting CWE-357 can lead to: Hide Activities.

Is CWE-357 actively exploited?

18 recorded CVEs are caused by CWE-357; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-357: Insufficient UI Warning of Dangerous Operations

Overview

CWE-357 (Insufficient UI Warning of Dangerous Operations) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

18 recorded CVEs are caused by CWE-357 (Insufficient UI Warning of Dangerous Operations). The highest-severity and most recent are shown first. 3 new CWE-357 CVEs have been recorded so far in 2026 (5 in 2025).

CVE-2025-49585
XWiki does not require right warnings for XClass definitions
High · CVSS 8.6 · EPSS 28th
2025-06-13
CVE-2025-49582
XWiki's required right warnings for macros are incomplete
High · CVSS 8.6 · EPSS 50th
2025-06-13
CVE-2025-33054
Remote Desktop Spoofing Vulnerability
High · CVSS 8.1 · EPSS 53th
2025-07-08
CVE-2024-43505
Microsoft Office Visio Remote Code Execution Vulnerability
High · CVSS 7.8 · EPSS 50th
2024-10-08
CVE-2021-22645
High · CVSS 7.8 · EPSS 72th
2021-02-23
CVE-2019-13521
High · CVSS 7.8 · EPSS 92th
2020-01-27
CVE-2026-26151
Remote Desktop Spoofing Vulnerability
High · CVSS 7.1 · EPSS 53th
2026-04-14
CVE-2022-41904
Medium · CVSS 6.5 · EPSS 33th
2022-11-11
CVE-2025-49587
XWiki does not require right warnings for notification displayer objects
Medium · CVSS 6.4 · EPSS 28th
2025-06-13
CVE-2024-43580
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Medium · CVSS 5.4 · EPSS 32th
2024-10-17
CVE-2024-21387
Medium · CVSS 5.3 · EPSS 50th
2024-01-26
CVE-2025-47967
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Medium · CVSS 4.7 · EPSS 26th
2025-09-16

Showing 12 of 18 recorded CWE-357 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-357 vulnerabilities

Common consequences

What can happen when CWE-357 is exploited.

Hide Activities

Affects: Non-Repudiation

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2007-1099 — User not sufficiently warned if host key mismatch occurs

How this weakness relates to others in the CWE hierarchy.

Parent

CWE-693: Protection Mechanism Failure

Child

CWE-450: Multiple Interpretations of UI Input

Terminology & mappings

Mapped taxonomies

PLOVER: Insufficient UI warning of dangerous operations

Frequently asked questions

Common questions about CWE-357.

What is CWE-357?: The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.
What CVEs are caused by CWE-357?: 18 recorded CVEs are attributed to CWE-357, including CVE-2025-49585, CVE-2025-49582, CVE-2025-33054.
What are the consequences of CWE-357?: Exploiting CWE-357 can lead to: Hide Activities.
Is CWE-357 actively exploited?: 18 recorded CVEs are caused by CWE-357; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.