Inappropriate Encoding for Output Context

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for e…CVE-2019-6110Openbsd · CVSS 6.8 · 25% likely

   OpenBSD

2. Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.CVE-2019-18981Pimcore · 1.4% likely

   Pimcore

3. Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu…CVE-2023-6512Google · CVSS 6.5 · 1.3% likely

   Google

4. MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientCVE-2026-55858mariadb-corporation · CVSS 5.9 · 0.9% likely

   Mariadb-Corporation

5. Web Gateway (MWG) - Inappropriate Encoding for output contextCVE-2020-7292McAfee · CVSS 4.3 · 0.9% likely

   McAfee

6. cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).CVE-2020-29135Cpanel · 0.6% likely

   Cpanel

7. Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chr…CVE-2023-3735Google · CVSS 4.3 · 0.6% likely

   Google

8. Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discret…CVE-2025-4052Google · CVSS 9.8 · 0.6% likely

   Google

9. Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vu…CVE-2024-11702Mozilla · CVSS 7.5 · 0.5% likely

   Mozilla

10. MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbCVE-2026-55859mariadb-corporation · CVSS 5.9 · 0.5% likely

    Mariadb-Corporation

11. util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passw…CVE-2018-9862Hyper · 0.4% likely

    Hyper

12. moodle: unsanitized HTML in site log for config_log_createdCVE-2024-34006Moodle · CVSS 4.3 · 0.4% likely

    Moodle

13. HTML injection in email body through email subjectCVE-2023-5770Proofpoint · CVSS 5.3 · 0.3% likely

    Proofpoint

14. MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingCVE-2026-119281mariadb-corporation · CVSS 5.9 · 0.3% likely

    Mariadb-Corporation

15. Round-trip Corruption via Improper Entity Escaping in xml_builderCVE-2026-47079joshnuss · CVSS 2.1 · 0.2% likely
16. Plaintext exposure of encrypted fields via ANSI code-page corruption of database nameCVE-2026-114650MongoDB · CVSS 5.9 · 0.1% likely

    MongoDB

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.