Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
352 CWEs ranked in 2026-07
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-416 | Use After Free | Allowed | 7429 |
| CWE-122 | Heap-based Buffer Overflow | Allowed | 6047 |
| CWE-125 | Out-of-bounds Read | Allowed | 3157 |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | Allowed-with-Review | 3071 |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Allowed | 2215 |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Discouraged | 1868 |
| CWE-284 | Improper Access Control | Discouraged | 1612 |
| CWE-190 | Integer Overflow or Wraparound | Allowed | 1374 |
| CWE-121 | Stack-based Buffer Overflow | Allowed | 1199 |
| CWE-862 | Missing Authorization | Allowed-with-Review | 1003 |
| CWE-908 | Use of Uninitialized Resource | Allowed | 928 |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | Allowed | 910 |
| CWE-918 | Server-Side Request Forgery (SSRF) | Allowed | 908 |
| CWE-502 | Deserialization of Untrusted Data | Allowed | 794 |
| CWE-20 | Improper Input Validation | Discouraged | 767 |
| CWE-770 | Allocation of Resources Without Limits or Throttling | Allowed | 755 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Allowed | 736 |
| CWE-285 | Improper Authorization | Discouraged | 712 |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Allowed-with-Review | 708 |
| CWE-863 | Incorrect Authorization | Allowed-with-Review | 701 |
| CWE-306 | Missing Authentication for Critical Function | Allowed | 681 |
| CWE-126 | Buffer Over-read | Allowed | 636 |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | Allowed | 589 |
| CWE-287 | Improper Authentication | Discouraged | 518 |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | Allowed | 510 |
| CWE-822 | Untrusted Pointer Dereference | Allowed | 470 |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | Allowed-with-Review | 453 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Allowed | 451 |
| CWE-23 | Relative Path Traversal | Allowed | 440 |
| CWE-400 | Uncontrolled Resource Consumption | Discouraged | 420 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Allowed | 403 |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Allowed-with-Review | 393 |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Allowed | 372 |
| CWE-269 | Improper Privilege Management | Discouraged | 367 |
| CWE-476 | NULL Pointer Dereference | Allowed | 350 |
| CWE-787 | Out-of-bounds Write | Allowed-with-Review | 343 |
| CWE-1220 | Insufficient Granularity of Access Control | Allowed | 330 |
| CWE-73 | External Control of File Name or Path | Allowed | 293 |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | Allowed | 292 |
| CWE-693 | Protection Mechanism Failure | Discouraged | 267 |
| CWE-197 | Numeric Truncation Error | Allowed | 260 |
| CWE-415 | Double Free | Allowed | 237 |
| CWE-295 | Improper Certificate Validation | Allowed | 216 |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | Allowed | 205 |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Allowed | 205 |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Discouraged | 203 |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Allowed | 189 |
| CWE-345 | Insufficient Verification of Data Authenticity | Discouraged | 185 |
| CWE-346 | Origin Validation Error | Allowed-with-Review | 175 |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | Allowed | 151 |