Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
768 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-408 | Incorrect Behavior Order: Early Amplification | Allowed | 8 |
| CWE-372 | Incomplete Internal State Distinction | Discouraged | 8 |
| CWE-223 | Omission of Security-relevant Information | Allowed | 8 |
| CWE-1419 | Incorrect Initialization of Resource | Allowed-with-Review | 8 |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | Allowed | 8 |
| CWE-1263 | Improper Physical Access Control | Allowed-with-Review | 8 |
| CWE-1241 | Use of Predictable Algorithm in Random Number Generator | Allowed | 8 |
| CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) | Allowed | 8 |
| CWE-1173 | Improper Use of Validation Framework | Allowed | 8 |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | Allowed | 7 |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | Allowed | 7 |
| CWE-777 | Regular Expression without Anchors | Allowed | 7 |
| CWE-771 | Missing Reference to Active Allocated Resource | Allowed | 7 |
| CWE-662 | Improper Synchronization | Discouraged | 7 |
| CWE-599 | Missing Validation of OpenSSL Certificate | Allowed | 7 |
| CWE-421 | Race Condition During Access to Alternate Channel | Allowed | 7 |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | Allowed | 7 |
| CWE-1389 | Incorrect Parsing of Numbers with Different Radices | Allowed | 7 |
| CWE-112 | Missing XML Validation | Allowed | 7 |
| CWE-914 | Improper Control of Dynamically-Identified Variables | Allowed | 6 |
| CWE-783 | Operator Precedence Logic Error | Allowed | 6 |
| CWE-710 | Improper Adherence to Coding Standards | Discouraged | 6 |
| CWE-671 | Lack of Administrator Control over Security | Allowed-with-Review | 6 |
| CWE-65 | Windows Hard Link | Allowed | 6 |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | Allowed | 6 |
| CWE-562 | Return of Stack Variable Address | Allowed | 6 |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | Allowed | 6 |
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | Allowed | 6 |
| CWE-37 | Path Traversal: '/absolute/pathname/here' | Allowed | 6 |
| CWE-342 | Predictable Exact Value from Previous Values | Allowed | 6 |
| CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | Allowed | 6 |
| CWE-262 | Not Using Password Aging | Allowed | 6 |
| CWE-249 | DEPRECATED: Often Misused: Path Manipulation | Prohibited | 6 |
| CWE-235 | Improper Handling of Extra Parameters | Allowed | 6 |
| CWE-192 | Integer Coercion Error | Allowed | 6 |
| CWE-1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution | Allowed | 6 |
| CWE-1357 | Reliance on Insufficiently Trustworthy Component | Allowed-with-Review | 6 |
| CWE-1320 | Improper Protection for Outbound Error Messages and Alert Signals | Allowed | 6 |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code | Allowed | 6 |
| CWE-1059 | Insufficient Technical Documentation | Prohibited | 6 |
| CWE-1038 | Insecure Automated Optimizations | Allowed-with-Review | 6 |
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | Allowed | 5 |
| CWE-839 | Numeric Range Comparison Without Minimum Check | Allowed | 5 |
| CWE-838 | Inappropriate Encoding for Output Context | Allowed | 5 |
| CWE-794 | Incomplete Filtering of Multiple Instances of Special Elements | Allowed | 5 |
| CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | Allowed | 5 |
| CWE-705 | Incorrect Control Flow Scoping | Allowed-with-Review | 5 |
| CWE-67 | Improper Handling of Windows Device Names | Allowed | 5 |