Skip to content
BackEsc
Sign in

CWE-134 · weakness in Memory Corruption

Use of Externally-Controlled Format String

417 CVEs · 3 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
3
likely to be exploited
35

Every one of the 417 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2,…CVE-2024-23113Fortinet · CVSS 9.8 · 62% likely

    Fortinet

  2. Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled…CVE-2019-1579Palo Alto Networks · CVSS 8.1 · 44% likely

    Palo Alto Networks

  3. Cisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityCVE-2020-3118Cisco · CVSS 8.8 · 12% likely

    Cisco

  4. AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.CVE-2020-1316081% likely
  5. iControl SOAP vulnerabilityCVE-2023-22374F5 · CVSS 7.5 · 71% likely

    F5

  6. Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1,…CVE-2012-185166% likely
  7. Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assi…CVE-2012-356948% likely
  8. The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory o…CVE-2018-631744% likely
  9. ASUS RT-AX56U V2 & RT-AC86U - Format String -1CVE-2023-35086ASUS · CVSS 7.2 · 39% likely

    ASUS

  10. Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string sp…CVE-2009-476938% likely
  11. Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote attackers to execute arbitrary code via…CVE-2012-228833% likely
  12. The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers t…CVE-2014-168331% likely
  13. Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a f…CVE-2006-346931% likely
  14. Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format str…CVE-2015-861723% likely
  15. Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string…CVE-2006-020020% likely
  16. Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via form…CVE-2008-353319% likely
  17. Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and 9.00.00.11063 and earlier, in 7-Technologies Interactive Graphical SC…CVE-2011-156819% likely
  18. Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX…CVE-2010-103919% likely
  19. Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via format string spec…CVE-2011-027016% likely
  20. Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.CVE-2009-373216% likely
  21. Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format…CVE-2009-121015% likely
  22. Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code…CVE-2009-366315% likely
  23. Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of service (application crash) or pos…CVE-2008-373414% likely
  24. Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possib…CVE-2010-209413% likely
  25. Format string vulnerability in the SMBDirList function in dirlist.c in SmbFTPD 0.96 allows remote attackers to execute arbitrary code via format string specifiers in a directory n…CVE-2007-518412% likely
  26. The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null b…CVE-2007-574012% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in