Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-838
Weakness type CWE-838 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 6 | 5 | 0 |
Monthly trend
▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃█▃▁
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 0 · 2026-06 0 · 2026-07 1 · 2026-08 3 · 2026-09 1 · 2026-10 0
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2019-6110 | 6.8 | 97.9 | — | — |
| CVE-2026-55858 | 5.9 | 58.2 | — | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mari… |
| CVE-2026-55859 | 5.9 | 40.5 | — | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encodin… |
| CVE-2026-53641 | 4.8 | 37.1 | — | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript te… |
| CVE-2026-47079 | 2.1 | 8.0 | — | Round-trip Corruption via Improper Entity Escaping in xml_builder |
| CVE-2026-84463 | 6.3 | 3.8 | — | Zammad: Stored HTML injection in Knowledge Base video widget enables forced session swi… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| mariadb-corporation | 2 |
| fossbilling | 1 |
| joshnuss | 1 |
| org.mariadb | 1 |
| zammad | 1 |
