Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-69880HIGHDesktop Window Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-69926HIGHDesktop Window Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-91709HIGHType confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbEPSS 0.4%CVE-2026-16355CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%CVE-2023-38073HIGHA vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenEPSS 0.4%CVE-2026-69308MEDIUMMicrosoft Standard XPS Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-50381MEDIUMComposite Image File System driver (cimfs.sys) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-121082HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-121218HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-121068HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-121226HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandEPSS 0.4%CVE-2026-121233HIGHType confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandboEPSS 0.4%CVE-2026-121221HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandEPSS 0.4%CVE-2026-121210HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-121094HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-121078HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandEPSS 0.4%CVE-2026-121137HIGHType confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrEPSS 0.4%CVE-2026-121228HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-18701HIGHType Confusion in MongoDB Query Subsystem Leads to Denial of ServiceEPSS 0.4%CVE-2026-118305CRITICALType confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox viEPSS 0.4%