...
CERT C++ Secure Coding Standard: FIO30-CPP. Exclude user input from format strings
The CERT Oracle Secure Coding Standard for Java: IDS06-J. Exclude user input from format strings
CERT Perl Secure Coding Standard: IDS30-PL. Exclude user input from format strings
ISO/IEC 9899:2011 Section 7.21.6, "Formatted input/output functions"
...