Weaknesses of type CWE-682

76 results

Cálculo incorreto

Ocorre quando o código realiza uma operação matemática ou lógica com erro na fórmula, na ordem de operações, ou na manipulação de tipos de dados, produzindo um resultado inesperado. O risco varia: pode levar a autorizações indevidas, contornos de validação, ou corrupção de dados sensíveis, dependendo de onde o cálculo é usado.

Example

Um sistema calcula o desconto em uma compra usando (preço * percentual) / 100, mas o desenvolvedor inverte e faz (preço / 100) * percentual, resultando em desconto 100 vezes menor. Ou um controle de acesso nega permissões com if(level > 5) quando deveria ser if(level < 5), invertendo a lógica de proteção.

How to mitigate

Valide todas as operações matemáticas com testes unitários que cobrem casos extremos (zero, negativos, overflow). Revise fórmulas críticas em code review com especialista, use constantes nomeadas em vez de valores mágicos, e implemente verificações de sanidade no resultado (ex: desconto nunca > 100%) antes de usar.

CVE-2026-16363CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.4%CVE-2025-5372MEDIUMLibssh: incorrect return code handling in ssh_kdf() in libsshEPSS 0.4%CVE-2023-36980—An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds thEPSS 0.4%CVE-2025-55552MEDIUMpytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.EPSS 0.4%CVE-2024-45056MEDIUM`fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolcEPSS 0.4%CVE-2025-59047LOWmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodEPSS 0.4%CVE-2026-1229LOWIncorrect calculation in CIRCL secp384r1 CombinedMultEPSS 0.4%CVE-2026-24783HIGHsoroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with NegativesEPSS 0.4%CVE-2024-32873LOWevmos allows transferring unvested tokens after delegationsEPSS 0.4%CVE-2026-44074LOWBitwise OR of errno valuesEPSS 0.3%CVE-2025-26622LOWsqrt doesn't define rounding behavior in VyperEPSS 0.3%CVE-2024-25883MEDIUMThe mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors.EPSS 0.3%CVE-2026-33487HIGHgoxmldsig has validateSignature Loop Variable Capture Signature BypassEPSS 0.3%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.3%CVE-2026-53706HIGHPREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programsEPSS 0.3%CVE-2026-53671CRITICALPREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verificationEPSS 0.3%CVE-2026-53670CRITICALPREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verificationEPSS 0.3%CVE-2026-10773MEDIUMOut-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)EPSS 0.3%CVE-2026-20270HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.3%CVE-2026-44498CRITICALZEBRA: Block Validator Undercounts Coinbase and P2SH SigopsEPSS 0.3%