CWE-704 不正确的类型转换 类弱点 72 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-704指不正确的类型转换或强制转换漏洞，属于逻辑错误类缺陷。当程序未能正确将对象或数据结构从一种类型转换为另一种类型时，可能导致数据损坏或意外行为。攻击者通常利用此漏洞通过构造特定输入，触发错误的类型处理逻辑，从而引发崩溃、数据泄露或执行恶意代码。开发者应避免使用不安全的强制转换，确保类型转换前后数据完整性，并实施严格的输入验证与类型检查机制，以消除潜在风险。
unsigned int readdata () { int amount = 0; ... amount = accessmainframe(); ... return amount; }#define NAME_TYPE 1 #define ID_TYPE 2 struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; int main (int argc, char **argv) { struct MessageBuffer buf; char *defaultMessage = "Hello World"; buf.msgType = NAME_TYPE; buf.name = defaultMessage; printf("Pointer of buf.name is %p\n", buf.name); /* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */ buf.nameID = (int)(defaultMessage + 1); printf("Pointer of buf.name is now %p\n", buf.name); if (buf.msgType == NAME_TYPE) { printf("Message: %| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-17211 | IBM API Connect 多个漏洞 — API Connect | 4.3 | Medium | 2026-11-07 |
| CVE-2026-122319 | Kyverno 1.19.2 之前版本拒绝服务漏洞 — kyverno | 7.5 | High | 2026-11-05 |
| CVE-2026-121589 | Spatie url-signer 远程代码执行漏洞 — url-signer | 5.3 | Medium | 2026-11-03 |
| CVE-2026-121262 | phpMyAdmin SQL 解析器类型转换漏洞 — SQL-Parser | 5.3 | Medium | 2026-11-03 |
| CVE-2026-104634 | Beam MCP JSON布尔和空值参数被解析为字符串漏洞 — beam_mcp | 2.3 | Low | 2026-10-08 |
| CVE-2026-104420 | Zebra < 6.3.0 通过泄露区块绕过对等方行为禁止漏洞 — zebra | 5.3 | Medium | 2026-10-02 |
| CVE-2026-20249 | 思科ASA IKEv2证书认证拒绝服务漏洞 — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.6 | High | 2026-09-16 |
| CVE-2026-86348 | Mattermost 处理逻辑错误漏洞 — Mattermost | 4.3 | Medium | 2026-09-14 |
| CVE-2026-87546 | Google Chrome 处理逻辑错误漏洞 — Chrome | - | - | 2026-09-09 |
| CVE-2026-69585 | Microsoft Windows 10 处理逻辑错误漏洞 — Windows 10 Version 1607 | 7.8 | High | 2026-09-08 |
| CVE-2026-10080 | Mattermost 处理逻辑错误漏洞 — Mattermost | 6.5 | Medium | 2026-08-17 |
| CVE-2026-15826 | WordPress User Profile Builder 处理逻辑错误漏洞 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 9.8 | Critical | 2026-08-15 |
| CVE-2026-53798 | RsyncProject Rsync 处理逻辑错误漏洞 — rsync | 5.3 | Medium | 2026-08-13 |
| CVE-2026-73429 | Eugene Russh 处理逻辑错误漏洞 — russh | 5.3 | Medium | 2026-08-12 |
| CVE-2026-50337 | Microsoft Windows 处理逻辑错误漏洞 — Windows 10 Version 1607 | 7.8 | High | 2026-07-14 |
| CVE-2026-59871 | isaacs node-tar 处理逻辑错误漏洞 — node-tar | 5.3 | Medium | 2026-07-08 |
| CVE-2026-48140 | NI grpc-device 处理逻辑错误漏洞 — grpc-device | 6.5 | Medium | 2026-06-19 |
| CVE-2026-44324 | free5GC 代码问题漏洞 — free5gc | 6.5 | Medium | 2026-05-27 |
| CVE-2023-7345 | Ledger Live 代码问题漏洞 — ledgerhq/hw-app-eth | 6.5 | Medium | 2026-05-19 |
| CVE-2026-42576 | apko 代码问题漏洞 — apko | 6.5 | Medium | 2026-05-09 |
| CVE-2026-40613 | Coturn 安全漏洞 — coturn | 7.5 | High | 2026-04-21 |
| CVE-2026-34379 | OpenEXR 安全漏洞 — openexr | 7.1 | High | 2026-04-06 |
| CVE-2021-4456 | MetaCPAN Net::CIDR::Set 安全漏洞 — Net::CIDR | 9.8 | - | 2026-02-27 |
| CVE-2025-40541 | SolarWinds Serv-U 代码问题漏洞 — Serv-U | 9.1 | Critical | 2026-02-24 |
| CVE-2025-40540 | SolarWinds Serv-U 代码问题漏洞 — Serv-U | 9.1 | Critical | 2026-02-24 |
| CVE-2025-40539 | SolarWinds Serv-U 代码问题漏洞 — Serv-U | 9.1 | Critical | 2026-02-24 |
| CVE-2026-25613 | MongoDB Server 安全漏洞 — MongoDB Server | 6.5 | Medium | 2026-02-10 |
| CVE-2026-25503 | iccDEV 安全漏洞 — iccDEV | 7.1 | High | 2026-02-03 |
| CVE-2026-22041 | Logging Redactor 安全漏洞 — loggingredactor | 9.1 | - | 2026-01-08 |
| CVE-2025-13720 | Google Chrome 安全漏洞 — Chrome | 8.8AI | High AI | 2025-12-02 |
CWE-704（不正确的类型转换） 是常见的弱点类别，本平台收录该类弱点关联的 72 条 CVE 漏洞。