Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
779 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-313 | Cleartext Storage in a File or on Disk | Allowed | 35 |
| CWE-1327 | Binding to an Unrestricted IP Address | Allowed | 35 |
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | Allowed | 35 |
| CWE-92 | DEPRECATED: Improper Sanitization of Custom Special Characters | Prohibited | 34 |
| CWE-523 | Unprotected Transport of Credentials | Allowed | 34 |
| CWE-241 | Improper Handling of Unexpected Data Type | Allowed | 34 |
| CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | Allowed | 34 |
| CWE-115 | Misinterpretation of Input | Allowed | 34 |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') | Allowed | 33 |
| CWE-279 | Incorrect Execution-Assigned Permissions | Allowed | 33 |
| CWE-690 | Unchecked Return Value to NULL Pointer Dereference | Discouraged | 32 |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | Allowed | 32 |
| CWE-299 | Improper Check for Certificate Revocation | Allowed | 32 |
| CWE-253 | Incorrect Check of Function Return Value | Allowed | 32 |
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | Allowed-with-Review | 31 |
| CWE-356 | Product UI does not Warn User of Unsafe Actions | Allowed | 31 |
| CWE-282 | Improper Ownership Management | Allowed-with-Review | 31 |
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | Allowed | 31 |
| CWE-833 | Deadlock | Allowed | 30 |
| CWE-460 | Improper Cleanup on Thrown Exception | Allowed | 30 |
| CWE-390 | Detection of Error Condition Without Action | Allowed | 30 |
| CWE-141 | Improper Neutralization of Parameter/Argument Delimiters | Allowed | 30 |
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | Allowed | 30 |
| CWE-684 | Incorrect Provision of Specified Functionality | Allowed-with-Review | 29 |
| CWE-625 | Permissive Regular Expression | Allowed | 29 |
| CWE-526 | Cleartext Storage of Sensitive Information in an Environment Variable | Allowed | 29 |
| CWE-296 | Improper Following of a Certificate's Chain of Trust | Allowed | 29 |
| CWE-27 | Path Traversal: 'dir/../../filename' | Allowed | 29 |
| CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | Allowed | 29 |
| CWE-391 | Unchecked Error Condition | Prohibited | 28 |
| CWE-286 | Incorrect User Management | Allowed-with-Review | 27 |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Allowed | 26 |
| CWE-270 | Privilege Context Switching Error | Allowed | 26 |
| CWE-260 | Password in Configuration File | Allowed | 26 |
| CWE-1230 | Exposure of Sensitive Information Through Metadata | Allowed | 26 |
| CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control | Allowed | 26 |
| CWE-759 | Use of a One-Way Hash without a Salt | Allowed | 25 |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | Allowed | 25 |
| CWE-403 | Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') | Allowed | 25 |
| CWE-273 | Improper Check for Dropped Privileges | Allowed | 25 |
| CWE-233 | Improper Handling of Parameters | Allowed | 25 |
| CWE-590 | Free of Memory not on the Heap | Allowed | 24 |
| CWE-242 | Use of Inherently Dangerous Function | Allowed | 24 |
| CWE-1329 | Reliance on Component That is Not Updateable | Allowed | 24 |
| CWE-75 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) | Discouraged | 23 |
| CWE-708 | Incorrect Ownership Assignment | Allowed | 23 |
| CWE-698 | Execution After Redirect (EAR) | Allowed | 23 |
| CWE-410 | Insufficient Resource Pool | Allowed | 23 |
| CWE-406 | Insufficient Control of Network Message Volume (Network Amplification) | Allowed-with-Review | 23 |
| CWE-402 | Transmission of Private Resources into a New Sphere ('Resource Leak') | Allowed-with-Review | 23 |