Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-763 | Release of Invalid Pointer or Reference | Allowed | 459 |
| CWE-129 | Improper Validation of Array Index | Allowed | 455 |
| CWE-294 | Authentication Bypass by Capture-replay | Allowed | 446 |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | Allowed | 442 |
| CWE-749 | Exposed Dangerous Method or Function | Allowed | 410 |
| CWE-1188 | Initialization of a Resource with an Insecure Default | Allowed | 394 |
| CWE-134 | Use of Externally-Controlled Format String | Allowed | 389 |
| CWE-1287 | Improper Validation of Specified Type of Input | Allowed | 386 |
| CWE-428 | Unquoted Search Path or Element | Allowed | 381 |
| CWE-436 | Interpretation Conflict | Allowed-with-Review | 369 |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code | Allowed | 359 |
| CWE-203 | Observable Discrepancy | Allowed | 358 |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Allowed | 346 |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | Allowed-with-Review | 344 |
| CWE-264 | Permissions, Privileges, and Access Controls | Prohibited | 336 |
| CWE-755 | Improper Handling of Exceptional Conditions | Discouraged | 331 |
| CWE-204 | Observable Response Discrepancy | Allowed | 322 |
| CWE-311 | Missing Encryption of Sensitive Data | Discouraged | 316 |
| CWE-170 | Improper Null Termination | Allowed | 312 |
| CWE-681 | Incorrect Conversion between Numeric Types | Allowed | 311 |
| CWE-131 | Incorrect Calculation of Buffer Size | Allowed | 311 |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | Allowed | 306 |
| CWE-15 | External Control of System or Configuration Setting | Allowed | 304 |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | Allowed-with-Review | 303 |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | Allowed | 303 |
| CWE-208 | Observable Timing Discrepancy | Allowed | 302 |
| CWE-636 | Not Failing Securely | Allowed-with-Review | 298 |
| CWE-668 | Exposure of Resource to Wrong Sphere | Discouraged | 296 |
| CWE-326 | Inadequate Encryption Strength | Allowed-with-Review | 292 |
| CWE-41 | Improper Resolution of Path Equivalence | Allowed | 291 |
| CWE-707 | Improper Neutralization | Discouraged | 289 |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | Allowed-with-Review | 286 |
| CWE-35 | Path Traversal: '.../...//' | Allowed | 281 |
| CWE-824 | Access of Uninitialized Pointer | Allowed | 278 |
| CWE-358 | Improperly Implemented Security Check for Standard | Allowed | 278 |
| CWE-384 | Session Fixation | Allowed | 274 |
| CWE-252 | Unchecked Return Value | Allowed | 273 |
| CWE-130 | Improper Handling of Length Parameter Inconsistency | Allowed | 259 |
| CWE-772 | Missing Release of Resource after Effective Lifetime | Allowed | 253 |
| CWE-459 | Incomplete Cleanup | Allowed | 253 |
| CWE-354 | Improper Validation of Integrity Check Value | Allowed | 253 |
| CWE-330 | Use of Insufficiently Random Values | Discouraged | 249 |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code | Allowed | 248 |
| CWE-280 | Improper Handling of Insufficient Permissions or Privileges | Allowed | 246 |
| CWE-494 | Download of Code Without Integrity Check | Allowed | 236 |
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | Allowed | 235 |
| CWE-305 | Authentication Bypass by Primary Weakness | Allowed | 233 |
| CWE-256 | Plaintext Storage of a Password | Allowed | 233 |
| CWE-259 | Use of Hard-coded Password | Allowed | 228 |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | Allowed | 226 |