Base de CVEs

CVE-2026-45452 Alta · 8.3 CWE-134 15/10/2026

Unitronics - CWE-134 Use of Externally-Controlled format string

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

CVE-2026-102062 Alta · 8.1 CWE-134 14/10/2026

Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used

An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.

CVE-2026-101966 Alta · 8.2 CWE-134 14/10/2026

Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service

A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.

CVE-2026-101965 Alta · 8.8 CWE-134 14/10/2026

Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.

CVE-2026-94520 Média · 4.9 CWE-134 13/10/2026

Microsoft SQL Server Denial of Service Vulnerability

Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

CVE-2026-85842 Alta · 7.8 CWE-134 13/10/2026

Windows Image Acquisition Elevation of Privilege Vulnerability

Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

CVE-2026-83585 Alta · 7.8 CWE-134 13/10/2026

Windows NTFS Elevation of Privilege Vulnerability

Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-76753 Crítica · 9.8 CWE-134 06/10/2026

Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager

A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.

CVE-2026-69395 Média · 6.5 CWE-134 08/09/2026

Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability

Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network.

CVE-2026-57877 Alta · 8.6 CWE-134 26/06/2026

GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr)

An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path. A remote attacker may exploit this vulnerability by sending crafted login data, potentially causing information disclosure, memory corruption, or a denial of service.

CVE-2026-10828 Média · 6.9 CWE-134 16/06/2026

Use of Externally-Controlled Format String em Moxa NPort W2150A-W4/W2250A-W4 Series

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.

CVE-2025-10262 Média · 6.3 CWE-134 16/06/2026

An unsanitized format validation vulnerability in Nokia SR Linux

Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges.

CVE-2026-6250 Alta · 8.1 CWE-134 11/06/2026

Authenticated Format String Injection on TP-Link Tapo C110

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

CVE-2026-6242 Média · 6.8 CWE-134 05/06/2026

Authenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520WS

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications.

CVE-2026-6241 Média · 6.8 CWE-134 05/06/2026

Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation.

CVE-2026-50211 Crítica · 9.8 CWE-134 04/06/2026

Exposed Factory Testing App Boundaries

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.

CVE-2026-7835 Baixa · 3.1 CWE-134 21/05/2026

Format string argument mismatch

A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input that triggers incorrect format string processing.

CVE-2026-6474 Média · 4.3 CWE-134 14/05/2026

PostgreSQL timeofday() can disclose portions of server memory

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVE-2026-44407 Alta · 7.5 CWE-134 07/05/2026

Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview

A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service.

CVE-2026-6539 Média · 4.4 CWE-134 30/04/2026

Notepad++ 8.9.3 Format String Injection via nativeLang.xml

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.

CVE-2026-3008 Média · 6.6 CWE-134 27/04/2026

Vulnerability in Notepad++

Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.

CVE-2026-6843 Média · 5.5 CWE-134 22/04/2026

Nano: nano: format string vulnerability leads to denial of service

A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.

CVE-2026-3509 Alta · 7.5 CWE-134 24/03/2026

CODESYS Control Audit Log Format String DoS

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

CVE-2026-33210 Crítica · 9.1 CWE-134 20/03/2026

Ruby JSON has a format string injection vulnerability

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

CVE-2025-68648 Alta · 7.2 CWE-134 10/03/2026

Use of Externally-Controlled Format String em Fortinet Fortianalyzer

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14 may allow an attacker to escalate its privileges via specially crafted requests.