CWE-838 · Input Validation and Logic
Inappropriate Encoding for Output Context
16CVEs
SortMost likely exploited
16 CVEs with CWE-838 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-6110In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for e…Openbsd · Openssh · CVSS 6.8 · 2019-01-31 | 6.8 | 25% | 2019-01-31 |
| CVE-2019-18981Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.Pimcore · Pimcore · 2019-11-15 | – | 1.4% | 2019-11-15 |
| CVE-2023-6512Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu…Google · Chrome · CVSS 6.5 · 2023-12-06 | 6.5 | 1.3% | 2023-12-06 |
| CVE-2026-55858MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientmariadb-corporation · mariadb-connector-j · CVSS 5.9 · 2026-08-28 | 5.9 | 0.9% | 2026-08-28 |
| CVE-2020-7292Web Gateway (MWG) - Inappropriate Encoding for output contextMcAfee · McAfee Web Gateway (MWG) · CVSS 4.3 · 2020-07-15 | 4.3 | 0.9% | 2020-07-15 |
| CVE-2020-29135cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).Cpanel · Cpanel · 2020-11-27 | – | 0.6% | 2020-11-27 |
| CVE-2023-3735Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chr…Google · Chrome · CVSS 4.3 · 2023-08-01 | 4.3 | 0.6% | 2023-08-01 |
| CVE-2025-4052Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discret…Google · Chrome · CVSS 9.8 · 2025-05-05 | 9.8 | 0.6% | 2025-05-05 |
| CVE-2024-11702Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vu…Mozilla · Firefox · CVSS 7.5 · 2024-11-26 | 7.5 | 0.5% | 2024-11-26 |
| CVE-2026-55859MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbmariadb-corporation · mariadb-connector-r2dbc · CVSS 5.9 · 2026-08-28 | 5.9 | 0.5% | 2026-08-28 |
| CVE-2018-9862util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passw…Hyper · Runv · 2018-04-09 | – | 0.4% | 2018-04-09 |
| CVE-2024-34006moodle: unsanitized HTML in site log for config_log_createdMoodle · Moodle · CVSS 4.3 · 2024-05-31 | 4.3 | 0.4% | 2024-05-31 |
| CVE-2023-5770HTML injection in email body through email subjectProofpoint · Proofpoint Enterprise Protection · CVSS 5.3 · 2024-01-09 | 5.3 | 0.3% | 2024-01-09 |
| CVE-2026-119281MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingmariadb-corporation · mariadb-connector-j · CVSS 5.9 · 2026-10-29 | 5.9 | 0.3% | 2026-10-29 |
| CVE-2026-47079Round-trip Corruption via Improper Entity Escaping in xml_builderjoshnuss · xml_builder · CVSS 2.1 · 2026-08-21 | 2.1 | 0.2% | 2026-08-21 |
| CVE-2026-114650Plaintext exposure of encrypted fields via ANSI code-page corruption of database nameMongoDB · C# Driver · CVSS 5.9 · 2026-10-22 | 5.9 | 0.1% | 2026-10-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.