Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
360 CWEs ranked in 2026-05
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Allowed | 642 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Allowed | 382 |
| CWE-862 | Missing Authorization | Allowed-with-Review | 289 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Allowed | 261 |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Allowed-with-Review | 258 |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | Allowed-with-Review | 222 |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Discouraged | 221 |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Allowed-with-Review | 216 |
| CWE-918 | Server-Side Request Forgery (SSRF) | Allowed | 213 |
| CWE-400 | Uncontrolled Resource Consumption | Discouraged | 197 |
| CWE-863 | Incorrect Authorization | Allowed-with-Review | 181 |
| CWE-287 | Improper Authentication | Discouraged | 165 |
| CWE-284 | Improper Access Control | Discouraged | 150 |
| CWE-122 | Heap-based Buffer Overflow | Allowed | 150 |
| CWE-770 | Allocation of Resources Without Limits or Throttling | Allowed | 147 |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Discouraged | 147 |
| CWE-20 | Improper Input Validation | Discouraged | 147 |
| CWE-787 | Out-of-bounds Write | Allowed-with-Review | 137 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Allowed | 136 |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Discouraged | 133 |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Allowed | 127 |
| CWE-295 | Improper Certificate Validation | Allowed | 114 |
| CWE-416 | Use After Free | Allowed | 111 |
| CWE-121 | Stack-based Buffer Overflow | Allowed | 111 |
| CWE-125 | Out-of-bounds Read | Allowed | 110 |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | Allowed | 103 |
| CWE-190 | Integer Overflow or Wraparound | Allowed | 103 |
| CWE-476 | NULL Pointer Dereference | Allowed | 82 |
| CWE-306 | Missing Authentication for Critical Function | Allowed | 82 |
| CWE-404 | Improper Resource Shutdown or Release | Allowed-with-Review | 78 |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | Allowed-with-Review | 74 |
| CWE-789 | Memory Allocation with Excessive Size Value | Allowed | 67 |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | Allowed | 63 |
| CWE-502 | Deserialization of Untrusted Data | Allowed | 61 |
| CWE-269 | Improper Privilege Management | Discouraged | 59 |
| CWE-285 | Improper Authorization | Discouraged | 56 |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Allowed | 55 |
| CWE-345 | Insufficient Verification of Data Authenticity | Discouraged | 52 |
| CWE-436 | Interpretation Conflict | Allowed-with-Review | 47 |
| CWE-347 | Improper Verification of Cryptographic Signature | Allowed | 47 |
| CWE-312 | Cleartext Storage of Sensitive Information | Allowed | 47 |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | Allowed | 47 |
| CWE-266 | Incorrect Privilege Assignment | Allowed | 44 |
| CWE-170 | Improper Null Termination | Allowed | 44 |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | Allowed-with-Review | 43 |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | Allowed-with-Review | 42 |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Allowed | 42 |
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | Allowed | 42 |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | Allowed | 40 |
| CWE-475 | Undefined Behavior for Input to API | Allowed | 40 |