Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-369 | Divide By Zero | Allowed | 225 |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query | Allowed | 223 |
| CWE-178 | Improper Handling of Case Sensitivity | Allowed | 223 |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | Allowed | 220 |
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | Allowed-with-Review | 210 |
| CWE-457 | Use of Uninitialized Variable | Allowed | 206 |
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | Allowed | 206 |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | Allowed | 200 |
| CWE-704 | Incorrect Type Conversion or Cast | Allowed-with-Review | 198 |
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers | Allowed | 196 |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | Allowed-with-Review | 195 |
| CWE-825 | Expired Pointer Dereference | Allowed | 192 |
| CWE-602 | Client-Side Enforcement of Server-Side Security | Allowed-with-Review | 192 |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | Allowed | 191 |
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | Allowed | 188 |
| CWE-325 | Missing Cryptographic Step | Allowed | 187 |
| CWE-117 | Improper Output Neutralization for Logs | Allowed | 183 |
| CWE-405 | Asymmetric Resource Consumption (Amplification) | Allowed-with-Review | 182 |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | Allowed | 176 |
| CWE-697 | Incorrect Comparison | Discouraged | 175 |
| CWE-297 | Improper Validation of Certificate with Host Mismatch | Allowed | 175 |
| CWE-1392 | Use of Default Credentials | Allowed | 174 |
| CWE-348 | Use of Less Trusted Source | Allowed | 172 |
| CWE-703 | Improper Check or Handling of Exceptional Conditions | Discouraged | 165 |
| CWE-399 | Resource Management Errors | Prohibited | 160 |
| CWE-99 | Improper Control of Resource Identifiers | Allowed-with-Review | 159 |
| CWE-281 | Improper Preservation of Permissions | Allowed | 158 |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Allowed | 157 |
| CWE-425 | Direct Request | Allowed | 152 |
| CWE-922 | Insecure Storage of Sensitive Information | Allowed-with-Review | 151 |
| CWE-183 | Permissive List of Allowed Inputs | Allowed | 148 |
| CWE-788 | Access of Memory Location After End of Buffer | Discouraged | 146 |
| CWE-606 | Unchecked Input for Loop Condition | Allowed | 146 |
| CWE-377 | DEPRECATED: Insecure Temporary File | Prohibited | 146 |
| CWE-823 | Use of Out-of-range Pointer Offset | Allowed | 145 |
| CWE-672 | Operation on a Resource after Expiration or Release | Allowed-with-Review | 145 |
| CWE-665 | Improper Initialization | Discouraged | 144 |
| CWE-524 | Use of Cache Containing Sensitive Information | Allowed | 142 |
| CWE-1288 | Improper Validation of Consistency within Input | Allowed | 140 |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | Allowed | 139 |
| CWE-840 | Business Logic Errors | Prohibited | 138 |
| CWE-24 | Path Traversal: '../filedir' | Allowed | 138 |
| CWE-489 | Active Debug Code | Allowed | 137 |
| CWE-91 | XML Injection | Allowed-with-Review | 136 |
| CWE-506 | Embedded Malicious Code | Allowed-with-Review | 135 |
| CWE-670 | Always-Incorrect Control Flow Implementation | Allowed-with-Review | 133 |
| CWE-669 | Incorrect Resource Transfer Between Spheres | Allowed-with-Review | 133 |
| CWE-682 | Incorrect Calculation | Discouraged | 132 |
| CWE-680 | Integer Overflow to Buffer Overflow | Discouraged | 132 |
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | Allowed | 130 |