Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
779 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-474 | Use of Function with Inconsistent Implementations | Allowed | 3 |
| CWE-468 | Incorrect Pointer Scaling | Allowed | 3 |
| CWE-447 | Unimplemented or Unsupported Feature in UI | Allowed | 3 |
| CWE-446 | UI Discrepancy for Security Feature | Allowed-with-Review | 3 |
| CWE-437 | Incomplete Model of Endpoint Features | Allowed | 3 |
| CWE-435 | Improper Interaction Between Multiple Correctly-Behaving Entities | Discouraged | 3 |
| CWE-344 | Use of Invariant Value in Dynamically Changing Context | Allowed | 3 |
| CWE-309 | Use of Password System for Primary Authentication | Allowed | 3 |
| CWE-239 | Failure to Handle Incomplete Element | Allowed | 3 |
| CWE-237 | Improper Handling of Structural Elements | Allowed | 3 |
| CWE-236 | Improper Handling of Undefined Parameters | Allowed | 3 |
| CWE-182 | Collapse of Data into Unsafe Value | Allowed | 3 |
| CWE-168 | Improper Handling of Inconsistent Special Elements | Allowed | 3 |
| CWE-1426 | Improper Validation of Generative AI Output | Discouraged | 3 |
| CWE-1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution | Allowed | 3 |
| CWE-1384 | Improper Handling of Physical or Environmental Conditions | Allowed-with-Review | 3 |
| CWE-1298 | Hardware Logic Contains Race Conditions | Allowed | 3 |
| CWE-1283 | Mutable Attestation or Measurement Reporting Data | Allowed | 3 |
| CWE-1279 | Cryptographic Operations are run Before Supporting Units are Ready | Allowed | 3 |
| CWE-1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection | Allowed | 3 |
| CWE-1231 | Improper Prevention of Lock Bit Modification | Allowed | 3 |
| CWE-1119 | Excessive Use of Unconditional Branching | Prohibited | 3 |
| CWE-1049 | Excessive Data Query Operations in a Large Data Table | Allowed | 3 |
| CWE-85 | Doubled Character XSS Manipulations | Allowed | 2 |
| CWE-769 | DEPRECATED: Uncontrolled File Descriptor Consumption | Prohibited | 2 |
| CWE-689 | Permission Race Condition During Resource Copy | Allowed | 2 |
| CWE-655 | Insufficient Psychological Acceptability | Allowed-with-Review | 2 |
| CWE-637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') | Allowed-with-Review | 2 |
| CWE-624 | Executable Regular Expression Error | Allowed | 2 |
| CWE-622 | Improper Validation of Function Hook Arguments | Allowed | 2 |
| CWE-563 | Assignment to Variable without Use | Allowed | 2 |
| CWE-531 | Inclusion of Sensitive Information in Test Code | Allowed | 2 |
| CWE-528 | Exposure of Core Dump File to an Unauthorized Control Sphere | Allowed | 2 |
| CWE-499 | Serializable Class Containing Sensitive Data | Allowed | 2 |
| CWE-479 | Signal Handler Use of a Non-reentrant Function | Allowed | 2 |
| CWE-46 | Path Equivalence: 'filename ' (Trailing Space) | Allowed | 2 |
| CWE-450 | Multiple Interpretations of UI Input | Allowed | 2 |
| CWE-422 | Unprotected Windows Messaging Channel ('Shatter') | Allowed | 2 |
| CWE-396 | Declaration of Catch for Generic Exception | Allowed | 2 |
| CWE-360 | Trust of System Event Data | Allowed | 2 |
| CWE-339 | Small Seed Space in PRNG | Allowed | 2 |
| CWE-32 | Path Traversal: '...' (Triple Dot) | Allowed | 2 |
| CWE-224 | Obscured Security-relevant Information by Alternate Name | Allowed | 2 |
| CWE-221 | Information Loss or Omission | Allowed-with-Review | 2 |
| CWE-205 | Observable Behavioral Discrepancy | Allowed | 2 |