Common Weakness Enumeration

Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.

Reset

773 CWEs

API response
CWE Name Mapping usage Occurrences
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Allowed 26878
CWE-122 Heap-based Buffer Overflow Allowed 12158
CWE-416 Use After Free Allowed 11858
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Allowed 11248
CWE-125 Out-of-bounds Read Allowed 8653
CWE-862 Missing Authorization Allowed-with-Review 8622
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Allowed-with-Review 5765
CWE-20 Improper Input Validation Discouraged 5619
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Discouraged 5456
CWE-352 Cross-Site Request Forgery (CSRF) Allowed 5443
CWE-284 Improper Access Control Discouraged 5013
CWE-121 Stack-based Buffer Overflow Allowed 4863
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Discouraged 4766
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Allowed 4317
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Allowed-with-Review 3995
CWE-94 Improper Control of Generation of Code ('Code Injection') Allowed-with-Review 3964
CWE-918 Server-Side Request Forgery (SSRF) Allowed 3814
CWE-787 Out-of-bounds Write Allowed-with-Review 3718
CWE-502 Deserialization of Untrusted Data Allowed 3541
CWE-190 Integer Overflow or Wraparound Allowed 3377
CWE-863 Incorrect Authorization Allowed-with-Review 3039
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Discouraged 2858
CWE-306 Missing Authentication for Critical Function Allowed 2725
CWE-434 Unrestricted Upload of File with Dangerous Type Allowed 2651
CWE-400 Uncontrolled Resource Consumption Discouraged 2606
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Allowed-with-Review 2599
CWE-287 Improper Authentication Discouraged 2438
CWE-770 Allocation of Resources Without Limits or Throttling Allowed 2409
CWE-639 Authorization Bypass Through User-Controlled Key Allowed 2372
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Allowed-with-Review 2055
CWE-285 Improper Authorization Discouraged 2054
CWE-476 NULL Pointer Dereference Allowed 1995
CWE-59 Improper Link Resolution Before File Access ('Link Following') Allowed 1776
CWE-269 Improper Privilege Management Discouraged 1740
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') Allowed 1461
CWE-126 Buffer Over-read Allowed 1407
CWE-191 Integer Underflow (Wrap or Wraparound) Allowed 1325
CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Allowed 1323
CWE-908 Use of Uninitialized Resource Allowed 1250
CWE-266 Incorrect Privilege Assignment Allowed 1185
CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Allowed 1049
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Allowed 1020
CWE-23 Relative Path Traversal Allowed 968
CWE-295 Improper Certificate Validation Allowed 950
CWE-427 Uncontrolled Search Path Element Allowed-with-Review 888
CWE-73 External Control of File Name or Path Allowed 883
CWE-822 Untrusted Pointer Dereference Allowed 882
CWE-347 Improper Verification of Cryptographic Signature Allowed 876
CWE-693 Protection Mechanism Failure Discouraged 865
CWE-532 Insertion of Sensitive Information into Log File Allowed 800