CVE-2026-12004 | High | 8.7 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-67244 | High | 7.2 | 2026-07-30 | A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration… |
CVE-2026-18188 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data… |
CVE-2026-18187 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an er… |
CVE-2026-18186 | High | 8.1 | 2026-07-30 | A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be… |
CVE-2026-6390 | Medium | 6.8 | 2026-07-23 | A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specia… |
CVE-2024-58366 | High | 8.5 | 2026-07-18 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scriptin… |
CVE-2026-15809 | High | 7.8 | 2026-07-15 | A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting envir… |
CVE-2026-15680 | High | 7.5 | 2026-07-13 | Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers t… |
CVE-2026-46465 | Medium | 5.5 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-57877 | High | 8.6 | 2026-06-26 | An unauthenticated
format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and
GV-LPC2211 V1.12 and earlier. The vulnerability is caused by imprope… |
CVE-2026-10828 | | | 2026-06-16 | A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1… |
CVE-2025-10262 | Medium | 6.3 | 2026-06-16 | Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability ma… |
CVE-2026-12174 | High | 8.8 | 2026-06-13 | A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the com… |
CVE-2026-6250 | High | 8.1 | 2026-06-11 | An
authenticated format string vulnerability exists in the ONVIF service of Tapo
C110 v2 due to improper handling of user-controlled input. Externally control… |
CVE-2026-6242 | | | 2026-06-06 | An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters… |
CVE-2026-6241 | | | 2026-06-06 | An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formattin… |
CVE-2026-50211 | Critical | 9.8 | 2026-06-04 | Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRA… |
CVE-2026-7835 | Low | 3.1 | 2026-05-21 | A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input t… |
CVE-2026-6474 | Medium | 4.3 | 2026-05-14 | Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. V… |
CVE-2026-44407 | Medium | 4.7 | 2026-05-07 | A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. |
CVE-2026-6539 | Medium | 4.4 | 2026-04-30 | Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and informa… |
CVE-2026-3008 | Medium | 6.6 | 2026-04-27 | Successful exploitation of the
string injection vulnerability could allow an attacker to obtain memory address
information or crash the application. |
CVE-2026-6843 | Medium | 5.5 | 2026-04-22 | A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containi… |
CVE-2026-3509 | High | 7.5 | 2026-03-24 | An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, poten… |
CVE-2026-33210 | Critical | 9.1 | 2026-03-20 | Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can… |
CVE-2025-68648 | High | 7.2 | 2026-03-10 | A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2… |
CVE-2026-0400 | Medium | 4.9 | 2026-02-24 | A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. |
CVE-2025-30269 | High | 8.1 | 2026-02-11 | A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then… |
CVE-2025-64157 | Medium | 6.7 | 2026-02-10 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11… |
CVE-2026-21640 | Low | 2.7 | 2026-01-20 | HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinatio… |
CVE-2025-68949 | Medium | 5.3 | 2026-01-13 | n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching i… |
CVE-2026-22190 | High | 7.5 | 2026-01-07 | The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-li… |
CVE-2025-53591 | Medium | 6.5 | 2026-01-02 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2023-53966 | Critical | 9.8 | 2025-12-22 | SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafte… |
CVE-2025-52666 | Low | 2.7 | 2025-11-20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable th… |
CVE-2025-48826 | High | 8.8 | 2025-10-07 | A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to… |
CVE-2025-53407 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53406 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52429 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-48730 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-36202 | High | 7.5 | 2025-09-22 | IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the imprope… |
CVE-2010-10017 | | | 2025-08-30 | WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly vali… |
CVE-2025-55298 | High | 7.5 | 2025-08-26 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format st… |
CVE-2011-10029 | | | 2025-08-20 | Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing format specifiers is sent, the… |
CVE-2012-10055 | | | 2025-08-13 | ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username con… |
CVE-2025-40600 | Critical | 9.8 | 2025-07-29 | Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption. |
CVE-2025-46123 | High | 7.2 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the… |
CVE-2025-46121 | Critical | 9.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `s… |
CVE-2025-22482 | High | 8.1 | 2025-06-06 | A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attack… |
CVE-2025-48388 | Medium | 6.5 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data… |
CVE-2024-45324 | High | 7.2 | 2025-03-11 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through… |
CVE-2024-55156 | Medium | 5.5 | 2025-02-21 | An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information… |
CVE-2023-40721 | Medium | 6.7 | 2025-02-11 | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or comma… |
CVE-2025-24359 | High | 8.4 | 2025-01-24 | ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can b… |
CVE-2024-12805 | High | 7.2 | 2025-01-09 | A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. |
CVE-2024-50403 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50402 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-42330 | Critical | 9.1 | 2024-11-27 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are create… |
CVE-2024-50401 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50400 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50399 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50398 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50397 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50396 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-9129 | | | 2024-10-22 | In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered.
Reported by Dylan Marino |
CVE-2024-45330 | High | 7.2 | 2024-10-08 | A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privil… |
CVE-2024-39529 | High | 7.5 | 2024-07-11 | A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthent… |
CVE-2024-4641 | Medium | 6.3 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an a… |
CVE-2024-6145 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-35845 | Critical | 9.1 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: dbg-tlv: ensure NUL termination
The iwl_fw_ini_debug_info_tlv is used as a… |
CVE-2023-45583 | Medium | 6.7 | 2024-05-14 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all ve… |
CVE-2023-36640 | Medium | 6.7 | 2024-05-14 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all ve… |
CVE-2021-34970 | Medium | 5.5 | 2024-05-07 | Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability. This vulnerability allows remote attackers to di… |
CVE-2024-23914 | Medium | 5.7 | 2024-05-03 | Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows.
When MC_Open_Association() function is used to open DICOM As… |
CVE-2024-31837 | High | 8.4 | 2024-04-30 | DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938. |
CVE-2023-48784 | Medium | 6.7 | 2024-04-09 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all ver… |
CVE-2023-41842 | Medium | 6.7 | 2024-03-12 | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or co… |
CVE-2023-29181 | High | 8.8 | 2024-02-22 | A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 t… |
CVE-2023-6764 | High | 8.1 | 2024-02-20 |
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX… |
CVE-2023-6399 | Medium | 5.7 | 2024-02-20 | A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Pa… |
CVE-2024-23113 | Critical | 9.8 | 2024-02-15 | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7… |
CVE-2023-24590 | High | 7.5 | 2023-12-18 |
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Cont… |
CVE-2023-36639 | High | 7.2 | 2023-12-13 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7… |
CVE-2023-48221 | High | 7.3 | 2023-11-20 | wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format… |
CVE-2023-5746 | Critical | 9.8 | 2023-10-25 | A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via… |
CVE-2022-26941 | Critical | 9.6 | 2023-10-19 | A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is imprope… |
CVE-2023-41349 | High | 8.8 | 2023-09-18 |
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attack… |
CVE-2023-39240 | High | 7.2 | 2023-09-07 |
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a speci… |
CVE-2023-39239 | High | 7.2 | 2023-09-07 |
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific v… |
CVE-2023-39238 | High | 7.2 | 2023-09-07 |
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_ipe… |
CVE-2023-4746 | High | 8.8 | 2023-09-04 | A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation l… |
CVE-2023-35087 | Critical | 9.8 | 2023-07-21 |
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when ca… |
CVE-2023-35086 | High | 7.2 | 2023-07-21 |
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when ca… |
CVE-2023-33011 | High | 8.8 | 2023-07-17 | A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2… |
CVE-2022-43953 | Medium | 6.7 | 2023-06-13 | A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all v… |
CVE-2023-2186 | High | 8.2 | 2023-06-07 | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format str… |
CVE-2023-21497 | Medium | 4.4 | 2023-05-04 | Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the memory addre… |
CVE-2023-22923 | Medium | 6.5 | 2023-05-01 | A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker to c… |
CVE-2023-25492 | Medium | 6.3 | 2023-05-01 | A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string inject… |