Fallos del tipo CWE-248

381 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-121443MEDIUMsvg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed TagEPSS 0.3%CVE-2026-46411MEDIUMFlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and olderEPSS 0.3%CVE-2026-94646HIGHApache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)EPSS 0.3%CVE-2026-27631LOWExiv2: Uncaught exception - cannot create std::vector larger than max_size()EPSS 0.3%CVE-2026-76892HIGHtsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processEPSS 0.3%CVE-2026-120215LOW@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hookEPSS 0.3%CVE-2024-54106HIGHNull pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availaEPSS 0.3%CVE-2024-20276HIGHA vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an EPSS 0.3%CVE-2025-59014MEDIUMDenial of Service in TYPO3 Bookmark ToolbarEPSS 0.3%CVE-2026-49096MEDIUMUncaught Exception in Kibana Cases Leading to Denial of ServiceEPSS 0.3%CVE-2026-79778MEDIUMrclone before v1.75.0 Denial of Service via TUS nil-response panicEPSS 0.3%CVE-2026-61544HIGHlibp2p-quic: Remote panic via certificate expiry race during QUIC handshakeEPSS 0.3%CVE-2026-106170MEDIUMAn Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, EPSS 0.3%CVE-2026-109855HIGHundici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakeEPSS 0.3%CVE-2026-96294HIGHApache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionEPSS 0.3%CVE-2026-90440HIGHApache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.3%CVE-2026-85493HIGHApache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)EPSS 0.3%CVE-2026-89312MEDIUMAesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEPSS 0.3%CVE-2023-6640MEDIUMSilicon Labs PC Controller v5.54.0 and Earlier Denial of Service VulnerabilityEPSS 0.3%CVE-2026-42545MEDIUMGranian: DoS via WSGI response header panicEPSS 0.3%