Weaknesses of type CWE-248

379 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-103936HIGHlibp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listenersEPSS 0.5%CVE-2026-14631MEDIUMwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerEPSS 0.5%CVE-2025-67647HIGHSvelteKit Denial of service and possible SSRF when using prerenderingEPSS 0.5%CVE-2024-31904MEDIUMIBM App Connect Enterprise denial of serviceEPSS 0.5%CVE-2026-31870HIGHcpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response HeaderEPSS 0.5%CVE-2026-52739MEDIUMZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier RejectionEPSS 0.5%CVE-2026-100347MEDIUMkin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathEPSS 0.5%CVE-2024-3052HIGHZ/IP Gateway S2 Nonce Get Denial of Service VulnerabilityEPSS 0.5%CVE-2026-63747HIGHSurrealDB before 3.1.0 Denial of Service via malformed RPC useEPSS 0.5%CVE-2025-48943MEDIUMvLLM allows clients to crash the openai server with invalid regexEPSS 0.5%CVE-2026-1528HIGHundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientEPSS 0.5%CVE-2026-12644MEDIUMVersions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.protoEPSS 0.5%CVE-2026-53496MEDIUMExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxesEPSS 0.5%CVE-2026-52738MEDIUMZEBRA: Finalized address balance credit-first overflow on consensus-valid blocksEPSS 0.5%CVE-2025-29785HIGHquic-go Has Panic in Path Probe Loss Recovery HandlingEPSS 0.5%CVE-2026-14181HIGH@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsEPSS 0.5%CVE-2026-23938LOWServer DoS via JavaScript preprocessing or script itemsEPSS 0.5%CVE-2026-65410HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mEPSS 0.5%CVE-2024-51750MEDIUMElement allows a malicious homeserver can modify events leading to unrenderable events or roomsEPSS 0.5%CVE-2024-21983MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.5%