CWE-134

Use of Externally-Controlled Format String

21 CVEs Avg CVSS 6.5 MITRE
0
CRITICAL
10
HIGH
9
MEDIUM
2
LOW
2
POC
0
KEV

Monthly

CVE-2026-3509 HIGH This Week

A format string vulnerability exists in the Audit Log component of CODESYS Control runtime system that allows unauthenticated remote attackers to inject malicious format specifiers into log messages. This affects numerous CODESYS Control products across multiple platforms including Windows, Linux, embedded systems (BeagleBone, Raspberry Pi, PFC100/200), and industrial controllers (Beckhoff CX, WAGO Touch Panels). Exploitation can lead to denial-of-service conditions by crashing the runtime system, with a CVSS score of 7.5 indicating high availability impact.

Information Disclosure
NVD VulDB
CVSS 3.1
7.5
EPSS
0.1%
CVE-2026-33210 HIGH PATCH This Week

A format string injection vulnerability exists in the Ruby JSON gem that can lead to denial of service attacks or information disclosure when parsing user-supplied documents with the non-default 'allow_duplicate_key: false' parsing option enabled. The vulnerability affects users of the pkg:rubygems/json package who have explicitly opted into using this specific parsing configuration. There is no evidence of active exploitation (not listed in CISA KEV), and no EPSS score is currently available for risk quantification.

Denial Of Service Information Disclosure
NVD GitHub VulDB
CVSS 4.0
8.3
EPSS
0.0%
CVE-2025-68648 HIGH This Week

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, Fort...

Fortinet Privilege Escalation Fortimanager Cloud Fortimanager Fortianalyzer Cloud +1
NVD VulDB
CVSS 3.1
7.2
EPSS
0.1%
CVE-2026-0400 MEDIUM This Month

SonicOS firewalls are vulnerable to a post-authentication format string vulnerability that permits authenticated remote attackers to trigger a denial of service condition and crash the affected device. The attack requires valid credentials but can be executed over the network without user interaction. No patch is currently available for this vulnerability.

Denial Of Service Sonicos
NVD
CVSS 3.1
4.9
EPSS
0.2%
CVE-2025-30269 HIGH This Week

A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory. [CVSS 8.1 HIGH]

Code Injection Qsync Central
NVD
CVSS 3.1
8.1
EPSS
0.0%
CVE-2025-64157 MEDIUM CISA This Month

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration. [CVSS 6.7 MEDIUM]

Fortinet Fortigate Fortios
NVD
CVSS 3.1
6.7
EPSS
0.0%
CVE-2026-21640 LOW Monitor

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error. [CVSS 2.7 LOW]

PHP
NVD
CVSS 3.1
2.7
EPSS
0.0%
CVE-2025-68949 MEDIUM PATCH This Month

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. [CVSS 5.3 MEDIUM]

Code Injection N8n
NVD GitHub
CVSS 3.1
5.3
EPSS
0.0%
CVE-2026-22190 HIGH POC This Week

Panda3D egg-mkfont up to version 1.10.16 contains a format string vulnerability in the -gp command-line option that allows attackers to read arbitrary stack memory and leak pointer values by injecting format specifiers into generated .egg and .png files. Public exploit code exists for this vulnerability, and no patch is currently available. This affects all users of the egg-mkfont utility who process untrusted input.

Code Injection Panda3d
NVD GitHub
CVSS 3.1
7.5
EPSS
0.0%
CVE-2025-53591 MEDIUM This Month

Quts Hero versions up to h5.2.0.2737 is affected by use of externally-controlled format string (CVSS 6.5).

Qnap Quts Hero Qts
NVD
CVSS 3.1
6.5
EPSS
0.1%
CVE-2026-3509
EPSS 0% CVSS 7.5
HIGH This Week

A format string vulnerability exists in the Audit Log component of CODESYS Control runtime system that allows unauthenticated remote attackers to inject malicious format specifiers into log messages. This affects numerous CODESYS Control products across multiple platforms including Windows, Linux, embedded systems (BeagleBone, Raspberry Pi, PFC100/200), and industrial controllers (Beckhoff CX, WAGO Touch Panels). Exploitation can lead to denial-of-service conditions by crashing the runtime system, with a CVSS score of 7.5 indicating high availability impact.

Information Disclosure
NVD VulDB
CVE-2026-33210
EPSS 0% CVSS 8.3
HIGH PATCH This Week

A format string injection vulnerability exists in the Ruby JSON gem that can lead to denial of service attacks or information disclosure when parsing user-supplied documents with the non-default 'allow_duplicate_key: false' parsing option enabled. The vulnerability affects users of the pkg:rubygems/json package who have explicitly opted into using this specific parsing configuration. There is no evidence of active exploitation (not listed in CISA KEV), and no EPSS score is currently available for risk quantification.

Denial Of Service Information Disclosure
NVD GitHub VulDB
CVE-2025-68648
EPSS 0% CVSS 7.2
HIGH This Week

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, Fort...

Fortinet Privilege Escalation Fortimanager Cloud +3
NVD VulDB
CVE-2026-0400
EPSS 0% CVSS 4.9
MEDIUM This Month

SonicOS firewalls are vulnerable to a post-authentication format string vulnerability that permits authenticated remote attackers to trigger a denial of service condition and crash the affected device. The attack requires valid credentials but can be executed over the network without user interaction. No patch is currently available for this vulnerability.

Denial Of Service Sonicos
NVD
CVE-2025-30269
EPSS 0% CVSS 8.1
HIGH This Week

A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory. [CVSS 8.1 HIGH]

Code Injection Qsync Central
NVD
CVE-2025-64157
EPSS 0% CVSS 6.7
MEDIUM This Month

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration. [CVSS 6.7 MEDIUM]

Fortinet Fortigate Fortios
NVD
CVE-2026-21640
EPSS 0% CVSS 2.7
LOW Monitor

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error. [CVSS 2.7 LOW]

PHP
NVD
CVE-2025-68949
EPSS 0% CVSS 5.3
MEDIUM PATCH This Month

n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. [CVSS 5.3 MEDIUM]

Code Injection N8n
NVD GitHub
CVE-2026-22190
EPSS 0% CVSS 7.5
HIGH POC This Week

Panda3D egg-mkfont up to version 1.10.16 contains a format string vulnerability in the -gp command-line option that allows attackers to read arbitrary stack memory and leak pointer values by injecting format specifiers into generated .egg and .png files. Public exploit code exists for this vulnerability, and no patch is currently available. This affects all users of the egg-mkfont utility who process untrusted input.

Code Injection Panda3d
NVD GitHub
CVE-2025-53591
EPSS 0% CVSS 6.5
MEDIUM This Month

Quts Hero versions up to h5.2.0.2737 is affected by use of externally-controlled format string (CVSS 6.5).

Qnap Quts Hero Qts
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy