Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-115 | Misinterpretation of Input | Allowed | 48 |
| CWE-540 | Inclusion of Sensitive Information in Source Code | Allowed | 47 |
| CWE-215 | Insertion of Sensitive Information Into Debugging Code | Allowed | 47 |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | Allowed | 46 |
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | Allowed | 46 |
| CWE-1104 | Use of Unmaintained Third Party Components | Allowed | 45 |
| CWE-691 | Insufficient Control Flow Management | Discouraged | 44 |
| CWE-356 | Missing User Interaction for Potentially Unsafe Action | Allowed | 44 |
| CWE-316 | Cleartext Storage of Sensitive Information in Memory | Allowed | 43 |
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | Allowed | 43 |
| CWE-65 | Windows Hard Link | Allowed | 42 |
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | Allowed | 41 |
| CWE-762 | Mismatched Memory Management Routines | Allowed | 41 |
| CWE-690 | Unchecked Return Value to NULL Pointer Dereference | Discouraged | 41 |
| CWE-274 | Improper Handling of Insufficient Privileges | Discouraged | 41 |
| CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | Allowed | 41 |
| CWE-1394 | Use of Default Cryptographic Key | Allowed | 41 |
| CWE-625 | Permissive Regular Expression | Allowed | 40 |
| CWE-526 | Cleartext Storage of Sensitive Information in an Environment Variable | Allowed | 40 |
| CWE-279 | Incorrect Execution-Assigned Permissions | Allowed | 39 |
| CWE-924 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | Allowed | 38 |
| CWE-460 | Improper Cleanup on Thrown Exception | Allowed | 38 |
| CWE-313 | Cleartext Storage in a File or on Disk | Allowed | 38 |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code | Allowed | 37 |
| CWE-273 | Improper Check for Dropped Privileges | Allowed | 36 |
| CWE-253 | Incorrect Check of Function Return Value | Allowed | 36 |
| CWE-141 | Improper Neutralization of Parameter/Argument Delimiters | Allowed | 36 |
| CWE-698 | Execution After Redirect (EAR) | Allowed | 35 |
| CWE-590 | Free of Memory not on the Heap | Allowed | 35 |
| CWE-523 | Unprotected Transport of Credentials | Allowed | 35 |
| CWE-308 | Use of Single-factor Authentication | Allowed | 35 |
| CWE-241 | Improper Handling of Unexpected Data Type | Allowed | 35 |
| CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | Allowed | 35 |
| CWE-92 | DEPRECATED: Improper Sanitization of Custom Special Characters | Prohibited | 34 |
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | Allowed-with-Review | 34 |
| CWE-684 | Incorrect Provision of Specified Functionality | Allowed-with-Review | 34 |
| CWE-391 | DEPRECATED: Unchecked Error Condition | Prohibited | 34 |
| CWE-363 | Race Condition Enabling Link Following | Allowed | 34 |
| CWE-282 | Improper Ownership Management | Allowed-with-Review | 34 |
| CWE-413 | Improper Resource Locking | Allowed | 32 |
| CWE-1050 | Excessive Platform Resource Consumption within a Loop | Allowed | 32 |
| CWE-393 | Return of Wrong Status Code | Allowed | 31 |
| CWE-296 | Improper Following of a Certificate's Chain of Trust | Allowed | 31 |
| CWE-140 | Improper Neutralization of Delimiters | Allowed | 31 |
| CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control | Allowed | 31 |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Allowed | 30 |
| CWE-394 | Unexpected Status Code or Return Value | Allowed | 30 |
| CWE-27 | Path Traversal: 'dir/../../filename' | Allowed | 29 |
| CWE-911 | Improper Update of Reference Count | Allowed | 28 |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | Allowed | 28 |