Weaknesses of type CWE-248

381 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-27790LOWUncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific reqEPSS 0.4%CVE-2026-54529MEDIUMSQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`EPSS 0.4%CVE-2026-114051HIGHvLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generateEPSS 0.4%CVE-2026-94642HIGHApache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionEPSS 0.4%CVE-2024-58112HIGHException capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliEPSS 0.4%CVE-2024-58111HIGHException capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliEPSS 0.4%CVE-2026-100675HIGHstoatchat before 0.15.5 Denial of Service via mass mentionsEPSS 0.4%CVE-2022-20761HIGHCisco 1000 Series Connected Grid Router Integrated Wireless Access Point Denial of Service VulnerabilityEPSS 0.4%CVE-2026-85014MEDIUMundici vulnerable to Denial of Service via WebSocketStream unclean closeEPSS 0.4%CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-110816MEDIUMqs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringEPSS 0.4%CVE-2023-26586MEDIUMUncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticatEPSS 0.4%CVE-2026-63341HIGHAedes has Uncaught Exception and Uncontrolled Resource ConsumptionEPSS 0.4%CVE-2026-102984HIGHAstro: Malformed port in the Host header can crash the Node adapterEPSS 0.4%CVE-2025-0657HIGHALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-rangeEPSS 0.4%CVE-2024-52903MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-86537HIGHApache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.4%CVE-2026-76493HIGHCisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception VulnerabilitiesEPSS 0.4%CVE-2026-88015MEDIUMrclone local: crafted Range request against a translated symlink panics (DoS)EPSS 0.4%CVE-2025-53620CRITICALCrashing any Qwik ServerEPSS 0.4%