Weaknesses of type CWE-248

381 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-121443MEDIUMsvg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed TagEPSS 0.3%CVE-2026-46411MEDIUMFlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and olderEPSS 0.3%CVE-2026-94646HIGHApache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)EPSS 0.3%CVE-2026-27631LOWExiv2: Uncaught exception - cannot create std::vector larger than max_size()EPSS 0.3%CVE-2026-76892HIGHtsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processEPSS 0.3%CVE-2026-120215LOW@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hookEPSS 0.3%CVE-2024-54106HIGHNull pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availaEPSS 0.3%CVE-2024-20276HIGHA vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an EPSS 0.3%CVE-2025-59014MEDIUMDenial of Service in TYPO3 Bookmark ToolbarEPSS 0.3%CVE-2026-49096MEDIUMUncaught Exception in Kibana Cases Leading to Denial of ServiceEPSS 0.3%CVE-2026-79778MEDIUMrclone before v1.75.0 Denial of Service via TUS nil-response panicEPSS 0.3%CVE-2026-61544HIGHlibp2p-quic: Remote panic via certificate expiry race during QUIC handshakeEPSS 0.3%CVE-2026-106170MEDIUMAn Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, EPSS 0.3%CVE-2026-109855HIGHundici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakeEPSS 0.3%CVE-2026-96294HIGHApache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionEPSS 0.3%CVE-2026-90440HIGHApache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.3%CVE-2026-85493HIGHApache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)EPSS 0.3%CVE-2026-89312MEDIUMAesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEPSS 0.3%CVE-2023-6640MEDIUMSilicon Labs PC Controller v5.54.0 and Earlier Denial of Service VulnerabilityEPSS 0.3%CVE-2026-42545MEDIUMGranian: DoS via WSGI response header panicEPSS 0.3%