CVE-2026-3509 is a high-severity vulnerability in CODESYS Control RTE (SL) version 3.5.17.0. It involves an unauthenticated remote attacker potentially controlling the format string of messages processed by the Audit Log, which can lead to a denial-of-service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability. No patch or official fix information is provided in the available data.
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
CVE-2025-30269 is a use of externally-controlled format string vulnerability in QNAP Systems Inc. 's Qsync Central product. A remote attacker with a valid user account can exploit this flaw to read secret data or modify memory, potentially leading to unauthorized information disclosure or application instability. The vulnerability affects Qsync Central versions 5.0.x.x prior to 5.0.0.4, which was patched in January 2026.
CVE-2025-68949 is a medium-severity vulnerability in the n8n workflow automation platform versions 1.36.0 up to but not including 2.2.0. The flaw lies in the Webhook node’s IP whitelist validation, which uses partial string matching instead of exact IP comparison. This allows an attacker with a non-whitelisted IP address that shares a substring with a trusted IP to bypass IP-based access controls and invoke restricted webhooks. Both IPv4 and IPv6 addresses are affected. The vulnerability does not require authentication or user interaction and impacts confidentiality by potentially exposing restricted workflows. The issue is fixed in version 2.
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.
We have already fixed the vulnerability in the following versions:
QTS 5.2.7.3256 build 20250913 and later
QuTS hero h5.2.7.3256 build 20250913 and later
QuTS hero h5.3.1.3250 build 20250912 and later
A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption. An attacker can send a series of HTTP requests to trigger this vulnerability.
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.
We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.
We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.
We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.
We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source.
ImageMagick versions prior to 6.9.13-28 and 7.1.2-2 contain a format string vulnerability in the InterpretImageFilename function. This flaw allows user input to be passed unsanitized to FormatLocaleString, leading to a write-what-where condition. Exploitation can result in arbitrary memory overwrite, potentially enabling heap overflow and remote code execution. The vulnerability is fixed in versions 6.9.13-28 and 7.1.2-2.
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols (\r, \n, \t)to the application. This issue has been patched in version 1.8.178.
CVE-2024-42330 is a critical vulnerability in Zabbix versions 6.0.0, 6.4.0, and 7.0.0 involving the HttpRequest object. The vulnerability arises because HTTP header strings returned from the server are not properly encoded for JavaScript, allowing crafted strings to access hidden object properties. This flaw is categorized as a CWE-134 Use of Externally-Controlled Format String and has a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability.
Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the HTTP server. A crafted Cookie header in an HTTP request can trigger the use of a format specifier from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the HTTP server. Was ZDI-CAN-21417.
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.
This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.