Weaknesses of type CWE-248

379 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-106122MEDIUMRabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersEPSS 0.5%CVE-2026-72813MEDIUMactix-files before 0.6.10 Denial of Service via empty Range headerEPSS 0.5%CVE-2026-24175HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tEPSS 0.5%CVE-2026-92954CRITICALvm2 3.10.0 through 3.11.7 Denial of Service via Host PromiseEPSS 0.5%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.5%CVE-2026-47480HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit ofEPSS 0.5%CVE-2026-77078HIGHmulter vulnerable to Denial of Service via crafted multipart field namesEPSS 0.5%CVE-2026-88411HIGHImproper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of SerEPSS 0.5%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.5%CVE-2025-48997HIGHMulter vulnerable to Denial of Service via unhandled exceptionEPSS 0.5%CVE-2026-32314HIGHYamux remote Panic via malformed Data frame with SYN set and len = 262145EPSS 0.5%CVE-2024-3051HIGHZ/IP Gateway Device Reset Locally Denial of Service VulnerabilityEPSS 0.5%CVE-2026-8161HIGHmultiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught ExceptionEPSS 0.5%CVE-2025-20097MEDIUMUncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 maEPSS 0.5%CVE-2024-58358MEDIUMSurrealDB before 2.1.0 Denial of Service via Nonexistent RoleEPSS 0.5%CVE-2025-54134HIGHHAX CMS NodeJs's Improper Error Handling Leads to Denial of ServiceEPSS 0.5%CVE-2026-20031MEDIUMClamAV CSS Image Parsing Error Handling Denial of Service VulnerabilityEPSS 0.5%CVE-2026-20068MEDIUMMultiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityEPSS 0.5%CVE-2026-92608HIGHApache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10EPSS 0.5%CVE-2025-44019HIGHAVEVA PI Data Archive Uncaught ExceptionEPSS 0.5%