Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-1108 | Excessive Reliance on Global Variables | Allowed | 4 |
| CWE-1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism | Allowed-with-Review | 4 |
| CWE-1024 | Comparison of Incompatible Types | Allowed | 4 |
| CWE-925 | Improper Verification of Intent by Broadcast Receiver | Allowed | 3 |
| CWE-910 | Use of Expired File Descriptor | Allowed | 3 |
| CWE-780 | Use of RSA Algorithm without OAEP | Allowed | 3 |
| CWE-756 | Missing Custom Error Page | Allowed | 3 |
| CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | Allowed | 3 |
| CWE-687 | Function Call With Incorrectly Specified Argument Value | Allowed | 3 |
| CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | Allowed | 3 |
| CWE-618 | Exposed Unsafe ActiveX Method | Allowed | 3 |
| CWE-605 | Multiple Binds to the Same Port | Allowed | 3 |
| CWE-597 | Use of Wrong Operator in String Comparison | Allowed | 3 |
| CWE-588 | Attempt to Access Child of a Non-structure Pointer | Allowed | 3 |
| CWE-55 | Path Equivalence: '/./' (Single Dot Directory) | Allowed | 3 |
| CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | Prohibited | 3 |
| CWE-514 | Covert Channel | Allowed-with-Review | 3 |
| CWE-509 | Replicating Malicious Code (Virus or Worm) | Allowed | 3 |
| CWE-474 | Use of Function with Inconsistent Implementations | Allowed | 3 |
| CWE-468 | Incorrect Pointer Scaling | Allowed | 3 |
| CWE-447 | Unimplemented or Unsupported Feature in UI | Allowed | 3 |
| CWE-446 | UI Discrepancy for Security Feature | Allowed-with-Review | 3 |
| CWE-437 | Incomplete Model of Endpoint Features | Allowed | 3 |
| CWE-435 | Improper Interaction Between Multiple Correctly-Behaving Entities | Discouraged | 3 |
| CWE-430 | Deployment of Wrong Handler | Allowed | 3 |
| CWE-344 | Use of Invariant Value in Dynamically Changing Context | Allowed | 3 |
| CWE-309 | Use of Password System for Primary Authentication | Allowed | 3 |
| CWE-30 | Path Traversal: '\dir\..\filename' | Allowed | 3 |
| CWE-28 | Path Traversal: '..\filedir' | Allowed | 3 |
| CWE-239 | Failure to Handle Incomplete Element | Allowed | 3 |
| CWE-236 | Improper Handling of Undefined Parameters | Allowed | 3 |
| CWE-21 | DEPRECATED: Pathname Traversal and Equivalence Errors | Prohibited | 3 |
| CWE-168 | Improper Handling of Inconsistent Special Elements | Allowed | 3 |
| CWE-1465 | Improper Session Invalidation after User Logout | Allowed | 3 |
| CWE-1464 | Improper Session Invalidation | Allowed | 3 |
| CWE-1426 | Improper Validation of Generative AI Output | Discouraged | 3 |
| CWE-1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution | Allowed | 3 |
| CWE-1384 | Improper Handling of Physical or Environmental Conditions | Allowed-with-Review | 3 |
| CWE-135 | Incorrect Calculation of Multi-Byte String Length | Allowed | 3 |
| CWE-1298 | Hardware Logic Contains Race Conditions | Allowed | 3 |
| CWE-1283 | Mutable Attestation or Measurement Reporting Data | Allowed | 3 |
| CWE-1279 | Cryptographic Operations are Run Before Supporting Units are Ready | Allowed | 3 |
| CWE-1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions | Allowed | 3 |
| CWE-1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks | Allowed | 3 |
| CWE-1231 | Improper Prevention of Lock Bit Modification | Allowed | 3 |
| CWE-1223 | Race Condition for Write-Once Attributes | Allowed | 3 |
| CWE-1119 | Excessive Use of Unconditional Branching | Prohibited | 3 |
| CWE-1116 | Inaccurate Source Code Comments | Allowed | 3 |
| CWE-1049 | Excessive Data Query Operations in a Large Data Table | Allowed | 3 |
| CWE-882 | CERT C++ Secure Coding Section 14 - Concurrency (CON) | Prohibited | 2 |