CWE-704 不正确的类型转换 类弱点 66 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-704指不正确的类型转换或强制转换漏洞，属于逻辑错误类缺陷。当程序未能正确将对象或数据结构从一种类型转换为另一种类型时，可能导致数据损坏或意外行为。攻击者通常利用此漏洞通过构造特定输入，触发错误的类型处理逻辑，从而引发崩溃、数据泄露或执行恶意代码。开发者应避免使用不安全的强制转换，确保类型转换前后数据完整性，并实施严格的输入验证与类型检查机制，以消除潜在风险。
unsigned int readdata () { int amount = 0; ... amount = accessmainframe(); ... return amount; }#define NAME_TYPE 1 #define ID_TYPE 2 struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; int main (int argc, char **argv) { struct MessageBuffer buf; char *defaultMessage = "Hello World"; buf.msgType = NAME_TYPE; buf.name = defaultMessage; printf("Pointer of buf.name is %p\n", buf.name); /* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */ buf.nameID = (int)(defaultMessage + 1); printf("Pointer of buf.name is now %p\n", buf.name); if (buf.msgType == NAME_TYPE) { printf("Message: %| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-20249 | 思科ASA IKEv2证书认证拒绝服务漏洞 — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.6 | High | 2026-09-16 |
| CVE-2026-86348 | Mattermost 处理逻辑错误漏洞 — Mattermost | 4.3 | Medium | 2026-09-14 |
| CVE-2026-87546 | Google Chrome 处理逻辑错误漏洞 — Chrome | - | - | 2026-09-09 |
| CVE-2026-69585 | Microsoft Windows 10 处理逻辑错误漏洞 — Windows 10 Version 1607 | 7.8 | High | 2026-09-08 |
| CVE-2026-10080 | Mattermost 处理逻辑错误漏洞 — Mattermost | 6.5 | Medium | 2026-08-17 |
| CVE-2026-15826 | WordPress User Profile Builder 处理逻辑错误漏洞 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 9.8 | Critical | 2026-08-15 |
| CVE-2026-53798 | RsyncProject Rsync 处理逻辑错误漏洞 — rsync | 5.3 | Medium | 2026-08-13 |
| CVE-2026-73429 | Eugene Russh 处理逻辑错误漏洞 — russh | 5.3 | Medium | 2026-08-12 |
| CVE-2026-50337 | Microsoft Windows 处理逻辑错误漏洞 — Windows 10 Version 1607 | 7.8 | High | 2026-07-14 |
| CVE-2026-59871 | isaacs node-tar 处理逻辑错误漏洞 — node-tar | 5.3 | Medium | 2026-07-08 |
| CVE-2026-48140 | NI grpc-device 处理逻辑错误漏洞 — grpc-device | 6.5 | Medium | 2026-06-19 |
| CVE-2026-44324 | free5GC 代码问题漏洞 — free5gc | 6.5 | Medium | 2026-05-27 |
| CVE-2023-7345 | Ledger Live 代码问题漏洞 — ledgerhq/hw-app-eth | 6.5 | Medium | 2026-05-19 |
| CVE-2026-42576 | apko 代码问题漏洞 — apko | 6.5 | Medium | 2026-05-09 |
| CVE-2026-40613 | Coturn 安全漏洞 — coturn | 7.5 | High | 2026-04-21 |
| CVE-2026-34379 | OpenEXR 安全漏洞 — openexr | 7.1 | High | 2026-04-06 |
| CVE-2021-4456 | MetaCPAN Net::CIDR::Set 安全漏洞 — Net::CIDR | 9.8 | - | 2026-02-27 |
| CVE-2025-40541 | SolarWinds Serv-U 代码问题漏洞 — Serv-U | 9.1 | Critical | 2026-02-24 |
| CVE-2025-40540 | SolarWinds Serv-U 代码问题漏洞 — Serv-U | 9.1 | Critical | 2026-02-24 |
| CVE-2025-40539 | SolarWinds Serv-U 代码问题漏洞 — Serv-U | 9.1 | Critical | 2026-02-24 |
| CVE-2026-25613 | MongoDB Server 安全漏洞 — MongoDB Server | 6.5 | Medium | 2026-02-10 |
| CVE-2026-25503 | iccDEV 安全漏洞 — iccDEV | 7.1 | High | 2026-02-03 |
| CVE-2026-22041 | Logging Redactor 安全漏洞 — loggingredactor | 9.1 | - | 2026-01-08 |
| CVE-2025-13720 | Google Chrome 安全漏洞 — Chrome | 8.8AI | High AI | 2025-12-02 |
| CVE-2025-62494 | QuickJS 安全漏洞 — QuickJS | 9.8AI | Critical AI | 2025-10-16 |
| CVE-2025-54429 | Polkadot Frontier 代码问题漏洞 — frontier | 7.5AI | High AI | 2025-07-28 |
| CVE-2025-41648 | Pilz IndustrialPI 代码问题漏洞 — IndustrialPI 4 with IndustrialPI webstatus | 9.8 | Critical | 2025-07-01 |
| CVE-2025-41646 | KUNBUS Revolution Pi 代码问题漏洞 — Revolution Pi webstatus | 9.8 | Critical | 2025-06-06 |
| CVE-2024-43058 | Qualcomm Chipsets 代码问题漏洞 — Snapdragon | 7.8 | High | 2025-04-07 |
| CVE-2025-1057 | Keylime 代码问题漏洞 | 4.3 | Medium | 2025-03-15 |
CWE-704（不正确的类型转换） 是常见的弱点类别，本平台收录该类弱点关联的 66 条 CVE 漏洞。