CWE · MITRE source
CWE-356Product UI does not Warn User of Unsafe Actions
The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.
Last updated: 14 October 2026 20:41 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
SC-15Collaborative Computing Devices and ApplicationsPR.PS-06
—
- 1 hardening rule · 1 OS baseline
—
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-15 | Collaborative Computing Devices and Applications | SC | Mandates explicit user-visible indication, directly countering absence of warnings for device activation. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2018-16858 UPD | 8.3 | 7.8 | 0.6732 | 2019-03-25 |
CVE-2019-6736 UPD | 7.1 | 8.8 | 0.0367 | 2019-06-03 |
CVE-2019-6737 UPD | 7.1 | 8.8 | 0.0382 | 2019-06-03 |
CVE-2019-6738 UPD | 7.1 | 8.8 | 0.0367 | 2019-06-03 |
CVE-2019-13322 UPD | 7.0 | 8.8 | 0.0255 | 2020-02-10 |
CVE-2022-39362 UPD | 6.7 | 8.8 | 0.0088 | 2022-10-26 |
CVE-2025-2450 UPD | 6.6 | 8.8 | 0.0053 | 2025-03-18 |
CVE-2025-3909 UPD | 6.1 | 8.1 | 0.0047 | 2025-05-14 |
CVE-2022-35873 UPD | 6.0 | 7.8 | 0.0071 | 2022-07-25 |
CVE-2022-36970 UPD | 5.9 | 7.8 | 0.0065 | 2023-03-29 |
CVE-2025-14403 UPD | 5.8 | 7.8 | 0.0031 | 2025-12-23 |
CVE-2026-0777 UPD | 5.8 | 7.8 | 0.0033 | 2026-02-20 |
CVE-2025-14412 UPD | 5.7 | 7.8 | 0.0020 | 2025-12-23 |
CVE-2025-14414 UPD | 5.7 | 7.8 | 0.0022 | 2025-12-23 |
CVE-2025-14415 UPD | 5.7 | 7.8 | 0.0025 | 2025-12-23 |
CVE-2025-14417 UPD | 5.7 | 7.8 | 0.0020 | 2025-12-23 |
CVE-2025-3839 UPD | 5.7 | 8.0 | 0.0040 | 2026-01-23 |
CVE-2025-31334 UPD | 5.5 | 6.8 | 0.0126 | 2025-04-03 |
CVE-2026-28593 | 5.5 | 7.8 | 0.0010 | 2026-09-08 |
CVE-2024-3044 UPD | 5.4 | 6.5 | 0.0101 | 2024-05-14 |
CVE-2025-14402 UPD | 5.2 | 7.0 | 0.0026 | 2025-12-23 |
CVE-2025-14404 UPD | 5.2 | 7.0 | 0.0026 | 2025-12-23 |
CVE-2025-14416 UPD | 5.1 | 7.0 | 0.0017 | 2025-12-23 |
CVE-2025-14418 UPD | 5.1 | 7.0 | 0.0017 | 2025-12-23 |
CVE-2018-10595 UPD | 4.9 | 6.3 | 0.0042 | 2018-05-24 |