Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-26 | Path Traversal: '/dir/../filename' | Allowed | 19 |
| CWE-229 | Improper Handling of Values | Allowed | 19 |
| CWE-179 | Incorrect Behavior Order: Early Validation | Allowed | 19 |
| CWE-1386 | Insecure Operation on Windows Junction / Mount Point | Allowed | 19 |
| CWE-838 | Inappropriate Encoding for Output Context | Allowed | 18 |
| CWE-642 | External Control of Critical State Data | Allowed-with-Review | 18 |
| CWE-573 | Improper Following of Specification by Caller | Allowed-with-Review | 18 |
| CWE-271 | Privilege Dropping / Lowering Errors | Allowed-with-Review | 18 |
| CWE-265 | Privilege Issues | Prohibited | 18 |
| CWE-258 | Empty Password in Configuration File | Allowed | 18 |
| CWE-174 | Double Decoding of the Same Data | Allowed | 18 |
| CWE-1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information | Allowed | 18 |
| CWE-1242 | Inclusion of Undocumented Features or Chicken Bits | Allowed | 18 |
| CWE-909 | Missing Initialization of Resource | Allowed-with-Review | 17 |
| CWE-19 | Data Processing Errors | Prohibited | 17 |
| CWE-173 | Improper Handling of Alternate Encoding | Allowed | 17 |
| CWE-159 | Improper Handling of Invalid Use of Special Elements | Allowed-with-Review | 17 |
| CWE-927 | Use of Implicit Intent for Sensitive Communication | Allowed | 16 |
| CWE-821 | Incorrect Synchronization | Allowed | 16 |
| CWE-645 | Overly Restrictive Account Lockout Mechanism | Allowed | 16 |
| CWE-628 | Function Call with Incorrectly Specified Arguments | Allowed | 16 |
| CWE-477 | Use of Obsolete Function | Allowed | 16 |
| CWE-449 | The UI Performs the Wrong Action | Allowed | 16 |
| CWE-351 | Insufficient Type Distinction | Allowed | 16 |
| CWE-329 | Generation of Predictable IV with CBC Mode | Allowed | 16 |
| CWE-25 | Path Traversal: '/../filedir' | Allowed | 16 |
| CWE-1259 | Improper Restriction of Security Token Assignment | Allowed | 16 |
| CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State | Allowed | 16 |
| CWE-1241 | Use of Predictable Algorithm in Random Number Generator | Allowed | 16 |
| CWE-1037 | Processor Optimization Removal or Modification of Security-critical Code | Allowed | 16 |
| CWE-1022 | Use of Web Link to Untrusted Target with window.opener Access | Allowed | 16 |
| CWE-842 | Placement of User into Incorrect Group | Allowed | 15 |
| CWE-692 | Incomplete Denylist to Cross-Site Scripting | Discouraged | 15 |
| CWE-547 | Use of Hard-coded, Security-relevant Constants | Allowed | 15 |
| CWE-372 | Incomplete Internal State Distinction | Discouraged | 15 |
| CWE-223 | Omission of Security-relevant Information | Allowed | 15 |
| CWE-196 | Unsigned to Signed Conversion Error | Allowed | 15 |
| CWE-826 | Premature Release of Resource During Expected Lifetime | Allowed | 14 |
| CWE-790 | Improper Filtering of Special Elements | Allowed-with-Review | 14 |
| CWE-760 | Use of a One-Way Hash with a Predictable Salt | Allowed | 14 |
| CWE-710 | Improper Adherence to Coding Standards | Discouraged | 14 |
| CWE-612 | Improper Authorization of Index Containing Sensitive Information | Allowed | 14 |
| CWE-549 | Missing Password Field Masking | Allowed | 14 |
| CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | Allowed | 14 |
| CWE-395 | Use of NullPointerException Catch to Detect NULL Pointer Dereference | Allowed | 14 |
| CWE-230 | Improper Handling of Missing Values | Allowed | 14 |
| CWE-705 | Incorrect Control Flow Scoping | Allowed-with-Review | 13 |
| CWE-701 | Weaknesses Introduced During Design | Prohibited | 13 |
| CWE-656 | Reliance on Security Through Obscurity | Allowed-with-Review | 13 |
| CWE-408 | Incorrect Behavior Order: Early Amplification | Allowed | 13 |