Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
254 CWEs ranked in 2025-12
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Allowed | 732 |
| CWE-862 | Missing Authorization | Allowed-with-Review | 403 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Allowed | 259 |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Discouraged | 208 |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Allowed | 181 |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | Allowed | 166 |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | Allowed-with-Review | 109 |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Allowed-with-Review | 101 |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Discouraged | 87 |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Allowed | 85 |
| CWE-121 | Stack-based Buffer Overflow | Allowed | 76 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Allowed | 73 |
| CWE-502 | Deserialization of Untrusted Data | Allowed | 71 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Allowed | 65 |
| CWE-306 | Missing Authentication for Critical Function | Allowed | 65 |
| CWE-284 | Improper Access Control | Discouraged | 58 |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Allowed-with-Review | 55 |
| CWE-20 | Improper Input Validation | Discouraged | 53 |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Discouraged | 51 |
| CWE-918 | Server-Side Request Forgery (SSRF) | Allowed | 50 |
| CWE-125 | Out-of-bounds Read | Allowed | 50 |
| CWE-863 | Incorrect Authorization | Allowed-with-Review | 40 |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Allowed | 39 |
| CWE-787 | Out-of-bounds Write | Allowed-with-Review | 37 |
| CWE-416 | Use After Free | Allowed | 37 |
| CWE-266 | Incorrect Privilege Assignment | Allowed | 37 |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | Allowed-with-Review | 37 |
| CWE-122 | Heap-based Buffer Overflow | Allowed | 36 |
| CWE-427 | Uncontrolled Search Path Element | Allowed-with-Review | 34 |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | Allowed | 30 |
| CWE-285 | Improper Authorization | Discouraged | 29 |
| CWE-770 | Allocation of Resources Without Limits or Throttling | Allowed | 24 |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | Allowed | 23 |
| CWE-190 | Integer Overflow or Wraparound | Allowed | 23 |
| CWE-798 | Use of Hard-coded Credentials | Allowed-with-Review | 21 |
| CWE-476 | NULL Pointer Dereference | Allowed | 19 |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | Allowed-with-Review | 19 |
| CWE-287 | Improper Authentication | Discouraged | 19 |
| CWE-428 | Unquoted Search Path or Element | Allowed | 17 |
| CWE-269 | Improper Privilege Management | Discouraged | 17 |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | Allowed-with-Review | 16 |
| CWE-693 | Protection Mechanism Failure | Discouraged | 14 |
| CWE-617 | Reachable Assertion | Allowed | 14 |
| CWE-347 | Improper Verification of Cryptographic Signature | Allowed | 14 |
| CWE-321 | Use of Hard-coded Cryptographic Key | Allowed | 14 |
| CWE-749 | Exposed Dangerous Method or Function | Allowed | 13 |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Allowed | 11 |
| CWE-290 | Authentication Bypass by Spoofing | Allowed | 11 |
| CWE-532 | Insertion of Sensitive Information into Log File | Allowed | 10 |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | Allowed-with-Review | 10 |