Falhas do tipo CWE-248

379 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-119188HIGHForge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageEPSS 0.4%CVE-2025-55553HIGHA syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).EPSS 0.4%CVE-2025-55557HIGHA Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of ServEPSS 0.4%CVE-2026-7183MEDIUMaligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exceptionEPSS 0.4%CVE-2025-36539HIGHAVEVA PI Data Archive Uncaught ExceptionEPSS 0.4%CVE-2026-122315HIGHKyverno before 1.19.2 Image Verification Bypass via Attestation Type PanicEPSS 0.4%CVE-2026-82058HIGHUnhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of ServiceEPSS 0.4%CVE-2026-67418MEDIUMRabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribersEPSS 0.4%CVE-2026-31949MEDIUMLibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convosEPSS 0.4%CVE-2025-9124HIGHRockwell Automation Compact GuardLogix® 5370 Denial-Of-Service VulnerabilityEPSS 0.4%CVE-2026-82417MEDIUMqs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertyEPSS 0.4%CVE-2026-42268HIGHModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operatorsEPSS 0.4%CVE-2026-19534HIGHundici vulnerable to Denial of Service via unrequested WebSocket subprotocolEPSS 0.4%CVE-2025-55194MEDIUMPart-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar UploadEPSS 0.4%CVE-2026-42544HIGHGranian: Unauthenticated DoS via WebSocket subprotocol header panicEPSS 0.4%CVE-2024-28835MEDIUMGnutls: potential crash during chain building/verificationEPSS 0.4%CVE-2023-1691—Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause featEPSS 0.4%CVE-2026-111181HIGHbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyEPSS 0.4%CVE-2026-27790LOWUncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific reqEPSS 0.4%CVE-2026-27844LOWUncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operEPSS 0.4%