Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-667 | Improper Locking | Allowed-with-Review | 73 |
| CWE-176 | Improper Handling of Unicode Encoding | Allowed | 73 |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | Allowed | 73 |
| CWE-1391 | Use of Weak Credentials | Allowed-with-Review | 72 |
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | Allowed | 71 |
| CWE-603 | Use of Client-Side Authentication | Allowed | 71 |
| CWE-289 | Authentication Bypass by Alternate Name | Allowed | 71 |
| CWE-1427 | Improper Neutralization of Input Used for LLM Prompting | Allowed | 71 |
| CWE-277 | Insecure Inherited Permissions | Allowed | 70 |
| CWE-440 | Expected Behavior Violation | Allowed | 69 |
| CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | Allowed | 69 |
| CWE-548 | Exposure of Information Through Directory Listing | Allowed | 68 |
| CWE-118 | Incorrect Access of Indexable Resource | Discouraged | 68 |
| CWE-834 | Excessive Iteration | Discouraged | 67 |
| CWE-270 | Privilege Context Switching Error | Allowed | 67 |
| CWE-782 | Exposed IOCTL with Insufficient Access Control | Allowed | 66 |
| CWE-16 | Configuration | Prohibited | 66 |
| CWE-29 | Path Traversal: '\..\filename' | Allowed | 65 |
| CWE-275 | Permission Issues | Prohibited | 65 |
| CWE-255 | Credentials Management Errors | Prohibited | 65 |
| CWE-1385 | Missing Origin Validation in WebSockets | Allowed | 65 |
| CWE-385 | Covert Timing Channel | Allowed | 64 |
| CWE-195 | Signed to Unsigned Conversion Error | Allowed | 64 |
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | Allowed | 64 |
| CWE-757 | Selection of Less-Secure Algorithm During Negotiation | Allowed | 63 |
| CWE-501 | Trust Boundary Violation | Allowed | 63 |
| CWE-185 | Incorrect Regular Expression | Allowed-with-Review | 63 |
| CWE-123 | Write-what-where Condition | Allowed | 63 |
| CWE-475 | Undefined Behavior for Input to API | Allowed | 62 |
| CWE-323 | Reusing a Nonce, Key Pair in Encryption | Allowed | 62 |
| CWE-791 | Incomplete Filtering of Special Elements | Allowed | 61 |
| CWE-378 | Creation of Temporary File With Insecure Permissions | Allowed | 61 |
| CWE-202 | Exposure of Sensitive Information Through Data Queries | Allowed | 61 |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | Allowed | 60 |
| CWE-272 | Least Privilege Violation | Allowed | 60 |
| CWE-1303 | Non-Transparent Sharing of Microarchitectural Resources | Allowed | 59 |
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | Allowed | 58 |
| CWE-300 | Channel Accessible by Non-Endpoint | Discouraged | 58 |
| CWE-453 | Insecure Default Variable Initialization | Allowed | 57 |
| CWE-353 | Missing Support for Integrity Check | Allowed | 57 |
| CWE-1025 | Comparison Using Wrong Factors | Allowed | 57 |
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | Allowed | 55 |
| CWE-771 | Missing Reference to Active Allocated Resource | Allowed | 54 |
| CWE-322 | Key Exchange without Entity Authentication | Allowed | 53 |
| CWE-1327 | Binding to an Unrestricted IP Address | Allowed | 53 |
| CWE-390 | Detection of Error Condition Without Action | Allowed | 52 |
| CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | Allowed | 52 |
| CWE-261 | Weak Encoding for Password | Allowed | 50 |
| CWE-1393 | Use of Default Password | Allowed | 49 |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | Allowed | 48 |