# CWE-838.

Every Advisory and CVE whose sources give the weakness CWE-838, newest first.

## Records, newest first

- [MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing](https://agentprime.io/advisories/GHSA-grfq-r75j-rw9x.md)
  `GHSA-grfq-r75j-rw9x`, `CVE-2026-119281` · Maven `org.mariadb.jdbc:mariadb-java-client`: affected `>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11`, fixed in `3.3.7`, `3.4.5`, `3.5.11` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-838
- [Plaintext exposure of encrypted fields via ANSI code-page corruption of database name](https://agentprime.io/advisories/CVE-2026-114650.md)
  `CVE-2026-114650` · CVE record: MongoDB C# Driver and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-838
- [Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute](https://agentprime.io/advisories/CVE-2026-84463.md)
  `CVE-2026-84463` · CVE record: zammad zammad · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), CWE-838
- [org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output](https://agentprime.io/advisories/GHSA-5rqc-86vf-g8r2.md)
  `GHSA-5rqc-86vf-g8r2`, `CVE-2026-55859` · Maven `org.mariadb:r2dbc-mariadb`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-116, CWE-838
- [org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context](https://agentprime.io/advisories/GHSA-xvr9-35cr-46v9.md)
  `GHSA-xvr9-35cr-46v9`, `CVE-2026-55858` · Maven `org.mariadb.jdbc:mariadb-java-client`: affected `<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9`, fixed in `2.7.14`, `3.3.5`, `3.4.3`, `3.5.9` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-838
- [Round-trip Corruption via Improper Entity Escaping in xml_builder](https://agentprime.io/advisories/GHSA-5hjx-8g53-cmvm.md)
  `GHSA-5hjx-8g53-cmvm`, `CVE-2026-47079`, `EEF-CVE-2026-47079` · Hex `xml_builder`: affected `>=0.0.6, <2.4.1`, fixed in `2.4.1` · CVSS 2.1 Low · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-838
- [FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal](https://agentprime.io/advisories/CVE-2026-53641.md)
  `CVE-2026-53641` · CVE record: FOSSBilling FOSSBilling · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-838
- [Google Chrome: Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed…](https://agentprime.io/advisories/CVE-2025-4052.md)
  `CVE-2025-4052` · CVE record: Google Chrome · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2025 · Tags: CWE-838
- [Mozilla Firefox: Copying sensitive information from Private Browsing tabs on Android, such as passwords…](https://agentprime.io/advisories/CVE-2024-11702.md)
  `CVE-2024-11702` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-838
- [Moodle Unsanitized HTML in site log for config_log_created](https://agentprime.io/advisories/GHSA-vvh5-7v3m-j3mj.md)
  `GHSA-vvh5-7v3m-j3mj`, `BIT-moodle-2024-34006`, `CVE-2024-34006`, `PKSA-81r7-dyqg-4q32` · Packagist `moodle/moodle`: affected `<4.1.10 || >=4.2.0, <4.2.7 || >=4.3.0, <4.3.4`, fixed in `4.1.10`, `4.2.7`, `4.3.4` · CVSS 4.3 Medium · Not analysed yet · Published 31 May 2024 · Tags: CWE-838
- [HTML injection in email body through email subject](https://agentprime.io/advisories/CVE-2023-5770.md)
  `CVE-2023-5770` · CVE record: Proofpoint Proofpoint Enterprise Protection · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2024 · Tags: CWE-838
- [Google Chrome: Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62…](https://agentprime.io/advisories/CVE-2023-6512.md)
  `CVE-2023-6512` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Dec 2023 · Tags: CWE-838
- [Google Chrome: Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2023-3735.md)
  `CVE-2023-3735` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 1 Aug 2023 · Tags: CWE-838
- [CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin](https://agentprime.io/advisories/GHSA-g66m-fqxf-3w35.md)
  `GHSA-g66m-fqxf-3w35`, `CVE-2022-43407` · Maven `org.jenkins-ci.plugins:pipeline-input-step`: affected `<456.vd8a_957db_5b_e9`, fixed in `456.vd8a_957db_5b_e9` · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2022 · Tags: Cross-site request forgery (CSRF), CWE-838
- [Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins](https://agentprime.io/advisories/GHSA-g975-f26h-93g8.md)
  `GHSA-g975-f26h-93g8`, `CVE-2022-43408` · Maven `org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view`: affected `>=2.25, <2.27 || <2.24.2`, fixed in `2.27`, `2.24.2` · CVSS 8.0 High · Not analysed yet · Published 19 Oct 2022 · Tags: Cross-site request forgery (CSRF), CWE-838
- [Pimcore Access Control Issues](https://agentprime.io/advisories/GHSA-jhcf-j4hg-v64r.md)
  `GHSA-jhcf-j4hg-v64r`, `CVE-2019-18981`, `PKSA-bykw-knd4-bwhg` · Packagist `pimcore/pimcore`: affected `<6.2.2`, fixed in `6.2.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: CWE-838
- [Web Gateway (MWG) - Inappropriate Encoding for output context](https://agentprime.io/advisories/CVE-2020-7292.md)
  `CVE-2020-7292` · CVE record: McAfee McAfee Web Gateway (MWG) · CVSS 4.3 Medium · Not analysed yet · Published 15 Jul 2020 · Tags: CWE-838
- [In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI c…](https://agentprime.io/advisories/CVE-2019-6110.md)
  `CVE-2019-6110` · CVE record · CVSS 6.8 Medium · EPSS 0.25 · Not analysed yet · Published 31 Jan 2019 · Tags: CWE-838

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-838>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-838/>. Everything for agents: <https://agentprime.io/llms.txt>.