CWE Weakness Categories

200 categories with tracked vulnerabilities, ranked by count.

Sort:
CWE-79 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
44,730
CVEs
CWE-89 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
19,395
CVEs
CWE-787 High
Out-of-bounds Write
14,104
CVEs
CWE-119 High
Improper Restriction of Operations within the Bounds of a Memory Buffer
13,938
CVEs
CWE-20 High
Improper Input Validation
12,423
CVEs
CWE-200 High
Exposure of Sensitive Information to an Unauthorized Actor
10,081
CVEs
CWE-352 Medium
Cross-Site Request Forgery (CSRF)
9,302
CVEs
CWE-22 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
9,091
CVEs
CWE-125
Out-of-bounds Read
8,775
CVEs
CWE-862 High
Missing Authorization
8,131
CVEs
CWE-416 High
Use After Free
7,433
CVEs
CWE-94 Medium
Improper Control of Generation of Code ('Code Injection')
6,457
CVEs
CWE-78 High
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
5,944
CVEs
CWE-476 Medium
NULL Pointer Dereference
5,257
CVEs
CWE-284
Improper Access Control
5,075
CVEs
CWE-74 High
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
4,792
CVEs
CWE-287 High
Improper Authentication
4,319
CVEs
CWE-120 High
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
4,198
CVEs
CWE-434 Medium
Unrestricted Upload of File with Dangerous Type
4,100
CVEs
CWE-77 High
Improper Neutralization of Special Elements used in a Command ('Command Injection')
3,551
CVEs
CWE-121 High
Stack-based Buffer Overflow
3,404
CVEs
CWE-190 Medium
Integer Overflow or Wraparound
3,172
CVEs
CWE-400 High
Uncontrolled Resource Consumption
3,094
CVEs
CWE-863 High
Incorrect Authorization
3,040
CVEs
CWE-269 Medium
Improper Privilege Management
2,771
CVEs
CWE-502 Medium
Deserialization of Untrusted Data
2,741
CVEs
CWE-918
Server-Side Request Forgery (SSRF)
2,678
CVEs
CWE-362 Medium
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
2,376
CVEs
CWE-306 High
Missing Authentication for Critical Function
2,343
CVEs
CWE-122 High
Heap-based Buffer Overflow
2,311
CVEs
CWE-770 High
Allocation of Resources Without Limits or Throttling
1,858
CVEs
CWE-639 High
Authorization Bypass Through User-Controlled Key
1,776
CVEs
CWE-401 Medium
Missing Release of Memory after Effective Lifetime
1,736
CVEs
CWE-798 High
Use of Hard-coded Credentials
1,712
CVEs
CWE-732 High
Incorrect Permission Assignment for Critical Resource
1,661
CVEs
CWE-59 Medium
Improper Link Resolution Before File Access ('Link Following')
1,518
CVEs
CWE-601 Low
URL Redirection to Untrusted Site ('Open Redirect')
1,513
CVEs
CWE-276 Medium
Incorrect Default Permissions
1,509
CVEs
CWE-295
Improper Certificate Validation
1,395
CVEs
CWE-522
Insufficiently Protected Credentials
1,358
CVEs
CWE-285 High
Improper Authorization
1,318
CVEs
CWE-611
Improper Restriction of XML External Entity Reference
1,250
CVEs
CWE-427
Uncontrolled Search Path Element
1,168
CVEs
CWE-98 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
1,149
CVEs
CWE-532 Medium
Insertion of Sensitive Information into Log File
1,137
CVEs
CWE-266
Incorrect Privilege Assignment
914
CVEs
CWE-319 High
Cleartext Transmission of Sensitive Information
882
CVEs
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
825
CVEs
CWE-312
Cleartext Storage of Sensitive Information
804
CVEs
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
788
CVEs
CWE-415 High
Double Free
786
CVEs
CWE-908 Medium
Use of Uninitialized Resource
761
CVEs
CWE-617
Reachable Assertion
748
CVEs
CWE-203
Observable Discrepancy
733
CVEs
CWE-404 Medium
Improper Resource Shutdown or Release
722
CVEs
CWE-668
Exposure of Resource to Wrong Sphere
719
CVEs
CWE-347
Improper Verification of Cryptographic Signature
686
CVEs
CWE-667
Improper Locking
682
CVEs
CWE-327 High
Use of a Broken or Risky Cryptographic Algorithm
669
CVEs
CWE-367 Medium
Time-of-check Time-of-use (TOCTOU) Race Condition
649
CVEs
CWE-426 High
Untrusted Search Path
639
CVEs
CWE-345
Insufficient Verification of Data Authenticity
591
CVEs
CWE-754 Medium
Improper Check for Unusual or Exceptional Conditions
588
CVEs
CWE-307
Improper Restriction of Excessive Authentication Attempts
586
CVEs
CWE-290
Authentication Bypass by Spoofing
575
CVEs
CWE-129 High
Improper Validation of Array Index
572
CVEs
CWE-755 Medium
Improper Handling of Exceptional Conditions
572
CVEs
CWE-288
Authentication Bypass Using an Alternate Path or Channel
568
CVEs
CWE-209 High
Generation of Error Message Containing Sensitive Information
561
CVEs
CWE-346
Origin Validation Error
556
CVEs
CWE-693
Protection Mechanism Failure
550
CVEs
CWE-80 High
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
538
CVEs
CWE-613
Insufficient Session Expiration
531
CVEs
CWE-311 High
Missing Encryption of Sensitive Data
508
CVEs
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
501
CVEs
CWE-552
Files or Directories Accessible to External Parties
474
CVEs
CWE-191
Integer Underflow (Wrap or Wraparound)
459
CVEs
CWE-772 High
Missing Release of Resource after Effective Lifetime
453
CVEs
CWE-126
Buffer Over-read
449
CVEs
CWE-73 High
External Control of File Name or Path
449
CVEs
CWE-326
Inadequate Encryption Strength
448
CVEs
CWE-116 High
Improper Encoding or Escaping of Output
446
CVEs
CWE-369 Medium
Divide By Zero
446
CVEs
CWE-674
Uncontrolled Recursion
430
CVEs
CWE-428
Unquoted Search Path or Element
427
CVEs
CWE-1333 High
Inefficient Regular Expression Complexity
426
CVEs
CWE-23
Relative Path Traversal
417
CVEs
CWE-384
Session Fixation
404
CVEs
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
388
CVEs
CWE-134 High
Use of Externally-Controlled Format String
387
CVEs
CWE-330 High
Use of Insufficiently Random Values
375
CVEs
CWE-922
Insecure Storage of Sensitive Information
373
CVEs
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
359
CVEs
CWE-665 Medium
Improper Initialization
347
CVEs
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
334
CVEs
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
333
CVEs
CWE-281
Improper Preservation of Permissions
329
CVEs
CWE-250 Medium
Execution with Unnecessary Privileges
326
CVEs
CWE-201
Insertion of Sensitive Information Into Sent Data
323
CVEs
CWE-1284
Improper Validation of Specified Quantity in Input
321
CVEs
CWE-321 High
Use of Hard-coded Cryptographic Key
297
CVEs
CWE-1236
Improper Neutralization of Formula Elements in a CSV File
292
CVEs
CWE-1188
Initialization of a Resource with an Insecure Default
288
CVEs
CWE-824
Access of Uninitialized Pointer
283
CVEs
CWE-640 High
Weak Password Recovery Mechanism for Forgotten Password
272
CVEs
CWE-704
Incorrect Type Conversion or Cast
268
CVEs
CWE-521
Weak Password Requirements
257
CVEs
CWE-829
Inclusion of Functionality from Untrusted Control Sphere
257
CVEs
CWE-707
Improper Neutralization
251
CVEs
CWE-451
User Interface (UI) Misrepresentation of Critical Information
230
CVEs
CWE-610
Externally Controlled Reference to a Resource in Another Sphere
227
CVEs
CWE-425
Direct Request ('Forced Browsing')
226
CVEs
CWE-294 High
Authentication Bypass by Capture-replay
219
CVEs
CWE-248
Uncaught Exception
206
CVEs
CWE-256 High
Plaintext Storage of a Password
204
CVEs
CWE-494 Medium
Download of Code Without Integrity Check
204
CVEs
CWE-822
Untrusted Pointer Dereference
200
CVEs
CWE-193
Off-by-one Error
198
CVEs
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
196
CVEs
CWE-259 High
Use of Hard-coded Password
194
CVEs
CWE-459
Incomplete Cleanup
189
CVEs
CWE-338 Medium
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
184
CVEs
CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
184
CVEs
CWE-131 High
Incorrect Calculation of Buffer Size
182
CVEs
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
175
CVEs
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
174
CVEs
CWE-457 High
Use of Uninitialized Variable
172
CVEs
CWE-252 Low
Unchecked Return Value
171
CVEs
CWE-35
Path Traversal: '.../...//'
169
CVEs
CWE-749 Low
Exposed Dangerous Method or Function
167
CVEs
CWE-354 Medium
Improper Validation of Integrity Check Value
160
CVEs
CWE-204
Observable Response Discrepancy
157
CVEs
CWE-789
Memory Allocation with Excessive Size Value
153
CVEs
CWE-697
Incorrect Comparison
150
CVEs
CWE-703
Improper Check or Handling of Exceptional Conditions
148
CVEs
CWE-788
Access of Memory Location After End of Buffer
147
CVEs
CWE-305
Authentication Bypass by Primary Weakness
146
CVEs
CWE-280
Improper Handling of Insufficient Permissions or Privileges
144
CVEs
CWE-61 High
UNIX Symbolic Link (Symlink) Following
138
CVEs
CWE-95 Medium
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
138
CVEs
CWE-208
Observable Timing Discrepancy
137
CVEs
CWE-1287
Improper Validation of Specified Type of Input
134
CVEs
CWE-670
Always-Incorrect Control Flow Implementation
134
CVEs
CWE-331
Insufficient Entropy
131
CVEs
CWE-91
XML Injection (aka Blind XPath Injection)
128
CVEs
CWE-36
Absolute Path Traversal
126
CVEs
CWE-682 High
Incorrect Calculation
126
CVEs
CWE-472
External Control of Assumed-Immutable Web Parameter
123
CVEs
CWE-184
Incomplete List of Disallowed Inputs
122
CVEs
CWE-358
Improperly Implemented Security Check for Standard
122
CVEs
CWE-602 Medium
Client-Side Enforcement of Server-Side Security
118
CVEs
CWE-681 High
Incorrect Conversion between Numeric Types
116
CVEs
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
115
CVEs
CWE-916
Use of Password Hash With Insufficient Computational Effort
115
CVEs
CWE-24
Path Traversal: '../filedir'
110
CVEs
CWE-436
Interpretation Conflict
109
CVEs
CWE-706
Use of Incorrectly-Resolved Name or Reference
107
CVEs
CWE-834
Excessive Iteration
107
CVEs
CWE-680
Integer Overflow to Buffer Overflow
104
CVEs
CWE-909 Medium
Missing Initialization of Resource
102
CVEs
CWE-117 Medium
Improper Output Neutralization for Logs
98
CVEs
CWE-1392
Use of Default Credentials
98
CVEs
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
98
CVEs
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
97
CVEs
CWE-942
Permissive Cross-domain Security Policy with Untrusted Domains
97
CVEs
CWE-669
Incorrect Resource Transfer Between Spheres
96
CVEs
CWE-823
Use of Out-of-range Pointer Offset
94
CVEs
CWE-130
Improper Handling of Length Parameter Inconsistency
93
CVEs
CWE-377
Insecure Temporary File
93
CVEs
CWE-441
Unintended Proxy or Intermediary ('Confused Deputy')
92
CVEs
CWE-763
Release of Invalid Pointer or Reference
92
CVEs
CWE-407 Low
Inefficient Algorithmic Complexity
90
CVEs
CWE-538
Insertion of Sensitive Information into Externally-Accessible File or Directory
90
CVEs
CWE-913
Improper Control of Dynamically-Managed Code Resources
90
CVEs
CWE-1220
Insufficient Granularity of Access Control
85
CVEs
CWE-506
Embedded Malicious Code
85
CVEs
CWE-303
Incorrect Implementation of Authentication Algorithm
84
CVEs
CWE-620
Unverified Password Change
82
CVEs
CWE-1390
Weak Authentication
81
CVEs
CWE-598
Use of HTTP Request With Sensitive Query String
80
CVEs
CWE-1286
Improper Validation of Syntactic Correctness of Input
79
CVEs
CWE-328
Use of Weak Hash
79
CVEs
CWE-489
Active Debug Code
79
CVEs
CWE-912
Hidden Functionality
79
CVEs
CWE-672
Operation on a Resource after Expiration or Release
78
CVEs
CWE-926
Improper Export of Android Application Components
78
CVEs
CWE-591
Sensitive Data Storage in Improperly Locked Memory
77
CVEs
CWE-807 High
Reliance on Untrusted Inputs in a Security Decision
76
CVEs
CWE-776 Medium
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
75
CVEs
CWE-565
Reliance on Cookies without Validation and Integrity Checking
74
CVEs
CWE-178
Improper Handling of Case Sensitivity
73
CVEs
CWE-277
Insecure Inherited Permissions
70
CVEs
CWE-799
Improper Control of Interaction Frequency
69
CVEs
CWE-15
External Control of System or Configuration Setting
65
CVEs
CWE-257 High
Storing Passwords in a Recoverable Format
64
CVEs
CWE-267
Privilege Defined With Unsafe Actions
64
CVEs
CWE-29
Path Traversal: '\..\filename'
64
CVEs
CWE-90
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
64
CVEs
CWE-648 Low
Incorrect Use of Privileged APIs
63
CVEs
CWE-614
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
58
CVEs