FortiManager and FortiAnalyzer API format-string flaw scores CVSS 7.2
An authenticated attacker can run unauthorized commands through a crafted HTTP request to the named cloud and on-prem APIs.
Stories per day · 30 days
Relatedcmp1cwe-1341fortianalyzer1fortimanager1fortinet1information-disclosure1nas1openssl1qnap1rce1syslog1ts-453e1zdi1
7 stories, newest first · one card per story
Stories tagged #format-string
OpenSSL CMP format-string flaw can leak data without login
ZDI rates CVE-2026-63073 at CVSS 6.5; remote attackers need no authentication, and no fixed version is named.
ZDI-26-776: QNAP TS-453E syslog log_message Format String Remote Code Execution Vulnerability
ZDI disclosed an unauthenticated format-string bug in QNAP TS-453E syslog enabling network-adjacent code execution.
[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)
SySS disclosed an unpatched medium-risk format-string flaw in GDCM 3.3.0, with no CVE assigned.
Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to the gpg.fail authors' retrospective, addressing format-nonliteral handling in time string formatting.
Re: Retrospective by 'gpg.fail' authors
GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.
Re: Retrospective by 'gpg.fail' authors
GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.