Weaknesses of type CWE-248

379 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-119188HIGHForge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageEPSS 0.4%CVE-2025-55553HIGHA syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).EPSS 0.4%CVE-2025-55557HIGHA Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of ServEPSS 0.4%CVE-2026-7183MEDIUMaligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exceptionEPSS 0.4%CVE-2025-36539HIGHAVEVA PI Data Archive Uncaught ExceptionEPSS 0.4%CVE-2026-82058HIGHUnhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of ServiceEPSS 0.4%CVE-2026-122315HIGHKyverno before 1.19.2 Image Verification Bypass via Attestation Type PanicEPSS 0.4%CVE-2026-31949MEDIUMLibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convosEPSS 0.4%CVE-2026-67418MEDIUMRabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribersEPSS 0.4%CVE-2025-9124HIGHRockwell Automation Compact GuardLogix® 5370 Denial-Of-Service VulnerabilityEPSS 0.4%CVE-2026-42268HIGHModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operatorsEPSS 0.4%CVE-2026-82417MEDIUMqs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertyEPSS 0.4%CVE-2026-19534HIGHundici vulnerable to Denial of Service via unrequested WebSocket subprotocolEPSS 0.4%CVE-2025-55194MEDIUMPart-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar UploadEPSS 0.4%CVE-2026-42544HIGHGranian: Unauthenticated DoS via WebSocket subprotocol header panicEPSS 0.4%CVE-2024-28835MEDIUMGnutls: potential crash during chain building/verificationEPSS 0.4%CVE-2023-1691—Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause featEPSS 0.4%CVE-2026-111181HIGHbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyEPSS 0.4%CVE-2026-27790LOWUncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific reqEPSS 0.4%CVE-2026-27844LOWUncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operEPSS 0.4%