Total
391 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-58366 | 2026-07-21 | N/A | 8.5 HIGH | ||
| SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges. | |||||
| CVE-2026-33210 | 1 Ruby-lang | 1 Json | 2026-07-21 | N/A | 9.1 CRITICAL |
| Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. | |||||
| CVE-2026-15809 | 2026-07-16 | N/A | 7.8 HIGH | ||
| A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. | |||||
| CVE-2026-15680 | 2026-07-14 | N/A | 7.5 HIGH | ||
| Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-25884. | |||||
| CVE-2026-22190 | 1 Cmu | 1 Panda3d | 2026-07-14 | N/A | 7.5 HIGH |
| The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single argument supplied. If an attacker provides additional format specifiers, egg-mkfont may read unintended stack values and write the formatted output into generated .egg and .png files, resulting in disclosure of stack-resident memory and pointer values. | |||||
| CVE-2026-46465 | 1 Dell | 1 Data Domain Operating System | 2026-07-08 | N/A | 5.5 MEDIUM |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service. | |||||
| CVE-2026-57877 | 2026-06-26 | N/A | 8.6 HIGH | ||
| An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path. A remote attacker may exploit this vulnerability by sending crafted login data, potentially causing information disclosure, memory corruption, or a denial of service. | |||||
| CVE-2026-7835 | 2026-06-17 | N/A | 3.1 LOW | ||
| A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input that triggers incorrect format string processing. | |||||
| CVE-2026-6843 | 2 Gnu, Redhat | 3 Nano, Enterprise Linux, Openshift Container Platform | 2026-06-17 | N/A | 5.5 MEDIUM |
| A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application. | |||||
| CVE-2026-6539 | 1 Notepad-plus-plus | 1 Notepad\+\+ | 2026-06-17 | N/A | 4.4 MEDIUM |
| Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents. | |||||
| CVE-2026-6474 | 1 Postgresql | 1 Postgresql | 2026-06-17 | N/A | 4.3 MEDIUM |
| Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. | |||||
| CVE-2026-6250 | 1 Tp-link | 2 Tapo C110, Tapo C110 Firmware | 2026-06-17 | N/A | 8.1 HIGH |
| An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption. | |||||
| CVE-2026-6242 | 2026-06-17 | N/A | N/A | ||
| An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications. | |||||
| CVE-2026-6241 | 2026-06-17 | N/A | N/A | ||
| An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation. | |||||
| CVE-2026-50211 | 1 Acer | 2 Connect M6e 5g, Connect M6e 5g Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers. | |||||
| CVE-2026-44407 | 1 Zte | 1 Zxcloud Irai | 2026-06-17 | N/A | 4.7 MEDIUM |
| A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. | |||||
| CVE-2026-3509 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition. | |||||
| CVE-2026-3008 | 2026-06-17 | N/A | 6.6 MEDIUM | ||
| Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application. | |||||
| CVE-2026-21640 | 1 Aquaplatform | 1 Revive Adserver | 2026-06-17 | N/A | 2.7 LOW |
| HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error. | |||||
| CVE-2026-12174 | 1 Dlink | 2 Dcs-935l, Dcs-935l Firmware | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. | |||||