Falhas do tipo CWE-248

379 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-54529MEDIUMSQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`EPSS 0.4%CVE-2026-114051HIGHvLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generateEPSS 0.4%CVE-2026-94642HIGHApache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionEPSS 0.4%CVE-2024-58111HIGHException capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliEPSS 0.4%CVE-2024-58112HIGHException capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliEPSS 0.4%CVE-2026-100675HIGHstoatchat before 0.15.5 Denial of Service via mass mentionsEPSS 0.4%CVE-2022-20761HIGHCisco 1000 Series Connected Grid Router Integrated Wireless Access Point Denial of Service VulnerabilityEPSS 0.4%CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-85014MEDIUMundici vulnerable to Denial of Service via WebSocketStream unclean closeEPSS 0.4%CVE-2026-110816MEDIUMqs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringEPSS 0.4%CVE-2023-26586MEDIUMUncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticatEPSS 0.4%CVE-2026-63341HIGHAedes has Uncaught Exception and Uncontrolled Resource ConsumptionEPSS 0.4%CVE-2026-102984HIGHAstro: Malformed port in the Host header can crash the Node adapterEPSS 0.4%CVE-2025-0657HIGHALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-rangeEPSS 0.4%CVE-2024-52903MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-86537HIGHApache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.4%CVE-2026-76493HIGHCisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception VulnerabilitiesEPSS 0.4%CVE-2026-88015MEDIUMrclone local: crafted Range request against a translated symlink panics (DoS)EPSS 0.4%CVE-2025-53620CRITICALCrashing any Qwik ServerEPSS 0.4%CVE-2026-107392MEDIUMmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)EPSS 0.4%