Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | Allowed | 41287 |
| CWE-416 | Use After Free | Allowed | 35536 |
| CWE-79 | Improper Neutralization of Input During Web Page Generation | Allowed | 34094 |
| CWE-125 | Out-of-bounds Read | Allowed | 26003 |
| CWE-862 | Missing Authorization | Allowed-with-Review | 14299 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command | Allowed | 14154 |
| CWE-121 | Stack-based Buffer Overflow | Allowed | 9027 |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory | Allowed-with-Review | 9025 |
| CWE-20 | Improper Input Validation | Discouraged | 8471 |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization | Allowed-with-Review | 8140 |
| CWE-190 | Integer Overflow or Wraparound | Allowed | 7920 |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Discouraged | 7479 |
| CWE-284 | Improper Access Control | Discouraged | 6728 |
| CWE-918 | Server-Side Request Forgery | Allowed | 6703 |
| CWE-787 | Out-of-bounds Write | Allowed-with-Review | 6695 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command | Allowed | 6486 |
| CWE-863 | Incorrect Authorization | Allowed-with-Review | 6168 |
| CWE-352 | Cross-Site Request Forgery | Allowed | 6074 |
| CWE-94 | Improper Control of Generation of Code | Allowed-with-Review | 6015 |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component | Discouraged | 6015 |
| CWE-502 | Deserialization of Untrusted Data | Allowed | 5806 |
| CWE-306 | Missing Authentication for Critical Functionality | Allowed | 5379 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Allowed | 4822 |
| CWE-770 | Allocation of Resources Without Limits or Throttling | Allowed | 4528 |
| CWE-400 | Uncontrolled Resource Consumption | Discouraged | 4101 |
| CWE-59 | Improper Link Resolution Before File Access | Allowed | 3989 |
| CWE-476 | NULL Pointer Dereference | Allowed | 3847 |
| CWE-126 | Buffer Over-read | Allowed | 3697 |
| CWE-77 | Improper Neutralization of Special Elements used in a Command | Allowed-with-Review | 3696 |
| CWE-287 | Improper Authentication | Discouraged | 3671 |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Discouraged | 3391 |
| CWE-908 | Use of Uninitialized Resource | Allowed | 3293 |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Allowed | 3224 |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | Allowed | 3217 |
| CWE-843 | Access of Resource Using Incompatible Type | Allowed | 3209 |
| CWE-822 | Untrusted Pointer Dereference | Allowed | 3120 |
| CWE-285 | Improper Authorization | Discouraged | 2843 |
| CWE-269 | Improper Privilege Management | Discouraged | 2605 |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Allowed | 2554 |
| CWE-415 | Double Free | Allowed | 2515 |
| CWE-120 | Buffer Copy without Checking Size of Input | Allowed-with-Review | 2361 |
| CWE-347 | Improper Verification of Cryptographic Signature | Allowed | 1915 |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Allowed | 1837 |
| CWE-295 | Improper Certificate Validation | Allowed | 1802 |
| CWE-266 | Incorrect Privilege Assignment | Allowed | 1722 |
| CWE-197 | Numeric Truncation Error | Allowed | 1625 |
| CWE-73 | External Control of File Name or Path | Allowed | 1577 |
| CWE-23 | Relative Path Traversal | Allowed | 1562 |
| CWE-601 | URL Redirection to Untrusted Site | Allowed | 1522 |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program | Allowed | 1476 |