CVE-2026-120059 is a format string vulnerability in the PostgreSQL psqlODBC driver versions before 18.00.0006. It occurs when an updatable cursor over a table without OIDs with an auto-increment int4 column uses the column name in a printf-style format string. If the column name contains format directives, this can cause the driver to read unrelated memory, potentially crashing the application or leaking client memory into queries sent to the server.
CVE-2026-63201 is a format string vulnerability in CESNET netopeer2 server versions prior to 2.8.21. A low-privileged authenticated NETCONF user can remotely cause a denial of service by sending a get RPC with an invalid subtree filter containing format specifiers. The vulnerability arises from improper handling of formatted log messages, leading to a crash of the netopeer2-server. The issue was confirmed on version 2.8.7 and fixed in version 2.8.21.
CVE-2026-45452 is a high-severity vulnerability in Unitronics UniStream Pro (B10 and C10 models) and UniLogic software versions prior to 1.41.329. It involves the use of externally-controlled format strings, which can lead to severe impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or cause denial of service.
CVE-2026-102062 is a high-severity vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series devices. It involves an externally-controlled format string flaw that allows an unauthenticated network attacker to execute code with root privileges by exploiting a compromised or impersonated HTTPS feed server configuration. The vulnerability affects multiple Junos OS versions prior to specific fixed releases. The CVSS score is 8.1, indicating a significant risk. No known exploits are reported in the wild at this time.
CVE-2026-101965 is a high-severity vulnerability in Juniper Networks Junos OS Evolved affecting the gRPC daemon. It involves an externally-controlled format string flaw in the gNMI service that can be exploited by an authenticated network attacker. Successful exploitation may lead to telemetry service disruption, information disclosure, or potentially root-level code execution.
CVE-2026-101966 is a Use of Externally-Controlled Format String vulnerability in the jti-dialoutd component of Juniper Networks Junos OS Evolved. It allows an authenticated network attacker to cause a persistent denial of service affecting telemetry dial-out by submitting a crafted analytics sensor resource through the gNMI listener. The vulnerability has a high severity with a CVSS score of 8.2. Multiple versions of Junos OS Evolved are affected, including specific ranges in 23.x, 25.x, and 26.x releases.
CVE-2026-94520 is a vulnerability in Microsoft SQL Server 2017 (GDR) involving the use of an externally-controlled format string. This flaw allows an authorized attacker to cause a denial of service (DoS) over a network. The vulnerability affects multiple versions of SQL Server 2017 and later, with fixes available in specified updates. The severity is rated medium with a CVSS score of 4.9. No known exploits are reported in the wild.
CVE-2026-83585 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving the use of an externally-controlled format string in the NTFS component. This flaw allows an authorized local attacker to elevate privileges by exploiting the format string issue. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-85842 is a high-severity vulnerability in Microsoft Windows 10 Version 21H2 involving the use of an externally-controlled format string in Windows Image Acquisition. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 10 21H2 prior to specific fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-14157 is a critical vulnerability in ASUS Router modules involving the use of an externally controlled format string. This flaw allows a remote authenticated user to execute arbitrary commands by uploading a specially crafted file via the router's web management interface. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. No specific affected versions or patches have been provided in the available data.
CVE-2026-47494 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux involving an externally-controlled format string issue. Exploitation could allow an attacker with local privileges to execute arbitrary code, escalate privileges, tamper with data, cause denial of service, or disclose sensitive information. The vulnerability requires local access and low complexity to exploit, with no user interaction needed. No specific affected versions or patches are currently detailed.
CVE-2026-18461 is a critical vulnerability in RTI Connext Professional Core Libraries involving an externally-controlled format string, leading to format string injection. It affects versions from 7.5.0 up to but not including 7.7.0.1, and from 7.3.0.10 up to but not including 7.3.1.6. The vulnerability has a high CVSS 4.0 score of 9.2, indicating severe impact if exploited. No known exploits are reported in the wild, and no vendor patch links are provided in the data.
CVE-2026-69395 is a vulnerability in Microsoft Windows 10 Version 1607 involving the use of an externally-controlled format string in Active Directory Certificate Services (AD CS). This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and affects multiple Windows 10 builds prior to specific fixed versions. Official patches are available to address this issue.
A format string vulnerability (CWE-134) exists in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, which could allow a local attacker to gain elevated privileges. The vulnerability has a high severity with a CVSS score of 7. It requires local access with high attack complexity and no user interaction. No official patch or remediation information is currently available.
CVE-2026-81574 is a high-severity vulnerability in Wibu-Systems-AG CodeMeter Runtime before versions 8.41a and 9.10. The logger component does not sanitize input strings properly, allowing attackers to inject printf-style format specifiers. This can cause the application to crash and potentially disclose sensitive information such as process memory and stack canaries. The vulnerability can be exploited locally by setting proxy values and remotely when combined with another vulnerability (CVE-2026-81573).
Multiple security vulnerabilities affect Red Hat OpenShift Container Platform versions including 4.12.98, 4.14, 4.15, 4.16 through 4.22.11. These include a bypass vulnerability in cri-o allowing /etc/passwd injection via the HOME environment variable (CVE-2026-15809), denial of service issues in Go language packages, privilege escalation via incorrect Punycode processing, and cross-site scripting in Go's html/template package. Red Hat has released updated RPM packages and container images to address these issues. Users are advised to upgrade to the fixed versions using the OpenShift CLI or web console.
CVE-2026-17136 is a critical format string vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This vulnerability could allow a remote attacker to execute arbitrary code without any privileges or user interaction. The flaw arises from improper handling of externally-controlled format strings.
CVE-2026-68553 is a format string vulnerability in coturn versions prior to 4.13.0. An authenticated TURN user can inject printf-style format specifiers into STUN USERNAME or REALM attributes, which are then used unsafely as format strings in Redis commands. This can lead to process crashes or disclosure of stack memory. The issue is fixed in coturn version 4.13.0.
CVE-2026-15961 is a medium severity vulnerability in IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It involves improper control of externally-controlled format strings, which could allow a local attacker with high privileges to obtain sensitive information or cause a denial of service. The vulnerability requires high attack complexity and privileges, with no user interaction needed.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.