Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-693 | Protection Mechanism Failure | Discouraged | 1376 |
| CWE-346 | Origin Validation Error | Allowed-with-Review | 1363 |
| CWE-522 | Insufficiently Protected Credentials | Allowed-with-Review | 1288 |
| CWE-532 | Insertion of Sensitive Information into Log File | Allowed | 1245 |
| CWE-427 | Uncontrolled Search Path Element | Allowed-with-Review | 1159 |
| CWE-345 | Insufficient Verification of Data Authenticity | Discouraged | 1112 |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | Allowed-with-Review | 1106 |
| CWE-1390 | Weak Authentication | Allowed-with-Review | 1097 |
| CWE-798 | Use of Hard-coded Credentials | Allowed-with-Review | 1085 |
| CWE-401 | Missing Release of Memory after Effective Lifetime | Allowed | 1084 |
| CWE-290 | Authentication Bypass by Spoofing | Allowed | 1074 |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | Allowed | 1074 |
| CWE-835 | Loop with Unreachable Exit Condition | Allowed | 996 |
| CWE-426 | Untrusted Search Path | Allowed-with-Review | 952 |
| CWE-674 | Uncontrolled Recursion | Allowed-with-Review | 884 |
| CWE-276 | Incorrect Default Permissions | Allowed | 864 |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Allowed | 847 |
| CWE-1220 | Insufficient Granularity of Access Control | Allowed | 847 |
| CWE-248 | Uncaught Exception | Allowed | 838 |
| CWE-444 | Inconsistent Interpretation of HTTP Requests | Allowed | 831 |
| CWE-404 | Improper Resource Shutdown or Release | Allowed-with-Review | 828 |
| CWE-209 | Generation of Error Message Containing Sensitive Information | Allowed | 823 |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | Allowed | 777 |
| CWE-611 | Improper Restriction of XML External Entity Reference | Allowed | 760 |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Allowed | 732 |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command | Allowed | 730 |
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes | Allowed | 718 |
| CWE-407 | Inefficient Algorithmic Complexity | Allowed-with-Review | 716 |
| CWE-613 | DEPRECATED: Insufficient Session Expiration | Prohibited | 713 |
| CWE-789 | Memory Allocation with Excessive Size Value | Allowed | 708 |
| CWE-617 | Reachable Assertion | Allowed | 703 |
| CWE-1333 | Inefficient Regular Expression Complexity | Allowed | 701 |
| CWE-250 | Execution with Unnecessary Privileges | Allowed | 685 |
| CWE-116 | Improper Encoding or Escaping of Output | Allowed-with-Review | 675 |
| CWE-319 | Cleartext Transmission of Sensitive Information | Allowed | 664 |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | Allowed | 651 |
| CWE-312 | Cleartext Storage of Sensitive Information | Allowed | 641 |
| CWE-552 | Files or Directories Accessible to External Parties | Allowed | 607 |
| CWE-193 | Off-by-one Error | Allowed | 598 |
| CWE-321 | Use of Hard-coded Cryptographic Key | Allowed | 565 |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | Allowed-with-Review | 555 |
| CWE-184 | Incomplete List of Disallowed Inputs | Allowed | 553 |
| CWE-1284 | Improper Validation of Specified Quantity in Input | Allowed | 532 |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | Allowed | 529 |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | Allowed-with-Review | 528 |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | Allowed | 514 |
| CWE-441 | Unintended Proxy or Intermediary | Allowed-with-Review | 489 |
| CWE-36 | Absolute Path Traversal | Allowed | 470 |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | Allowed | 464 |
| CWE-93 | Improper Neutralization of CRLF Sequences | Allowed | 462 |