Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-406 | Insufficient Control of Network Message Volume (Network Amplification) | Allowed-with-Review | 28 |
| CWE-364 | Signal Handler Race Condition | Allowed | 28 |
| CWE-286 | Incorrect User Management | Allowed-with-Review | 28 |
| CWE-233 | Improper Handling of Parameters | Allowed | 28 |
| CWE-759 | Use of a One-Way Hash without a Salt | Allowed | 27 |
| CWE-403 | Exposure of File Descriptor to Unintended Control Sphere | Allowed | 27 |
| CWE-366 | Race Condition within a Thread | Allowed | 27 |
| CWE-1230 | Exposure of Sensitive Information Through Metadata | Allowed | 27 |
| CWE-694 | Use of Multiple Resources with Duplicate Identifier | Allowed | 26 |
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | Allowed | 26 |
| CWE-643 | Improper Neutralization of Data within XPath Expressions | Allowed | 26 |
| CWE-260 | Password in Configuration File | Allowed | 26 |
| CWE-1329 | Reliance on Component That is Not Updateable | Allowed | 26 |
| CWE-114 | Process Control | Discouraged | 26 |
| CWE-836 | Use of Password Hash Instead of Password for Authentication | Allowed | 25 |
| CWE-708 | Incorrect Ownership Assignment | Allowed | 25 |
| CWE-657 | Violation of Secure Design Principles | Discouraged | 25 |
| CWE-410 | Insufficient Resource Pool | Allowed | 25 |
| CWE-402 | Transmission of Private Resources into a New Sphere | Allowed-with-Review | 25 |
| CWE-337 | Predictable Seed in Pseudo-Random Number Generator (PRNG) | Allowed | 25 |
| CWE-324 | Use of a Key Past its Expiration Date | Allowed | 25 |
| CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) | Allowed | 25 |
| CWE-837 | Improper Enforcement of a Single, Unique Action | Allowed | 24 |
| CWE-804 | Guessable CAPTCHA | Allowed | 24 |
| CWE-75 | Failure to Sanitize Special Elements into a Different Plane | Discouraged | 24 |
| CWE-335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) | Allowed | 24 |
| CWE-242 | Use of Inherently Dangerous Function | Allowed | 24 |
| CWE-172 | Improper Encoding or Decoding of Data | Allowed-with-Review | 24 |
| CWE-1357 | Reliance on Insufficiently Trustworthy Component | Allowed-with-Review | 24 |
| CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | Allowed | 23 |
| CWE-244 | Improper Clearing of Heap Memory Before Release | Allowed | 23 |
| CWE-155 | Improper Neutralization of Wildcards or Matching Symbols | Allowed | 23 |
| CWE-1295 | Debug Messages Revealing Unnecessary Information | Allowed | 23 |
| CWE-820 | Missing Synchronization | Allowed | 22 |
| CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | Allowed | 22 |
| CWE-592 | DEPRECATED: Authentication Bypass Issues | Prohibited | 22 |
| CWE-268 | Privilege Chaining | Allowed | 22 |
| CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges | Allowed | 22 |
| CWE-341 | Predictable from Observable State | Allowed | 21 |
| CWE-334 | Small Space of Random Values | Allowed | 21 |
| CWE-228 | Improper Handling of Syntactically Invalid Structure | Allowed-with-Review | 21 |
| CWE-138 | Improper Neutralization of Special Elements | Discouraged | 21 |
| CWE-127 | Buffer Under-read | Allowed | 21 |
| CWE-779 | Logging of Excessive Data | Allowed | 20 |
| CWE-76 | Improper Neutralization of Equivalent Special Elements | Allowed | 20 |
| CWE-650 | Trusting HTTP Permission Methods on the Server Side | Allowed | 20 |
| CWE-567 | Unsynchronized Access to Shared Data in a Multithreaded Context | Allowed | 20 |
| CWE-564 | Use of Hibernate with HQL/SQL Query String Containing External Input | Allowed | 20 |
| CWE-480 | Use of Incorrect Operator | Allowed | 20 |
| CWE-392 | Missing Report of Error Condition | Allowed | 19 |