CWE Weakness Categories

200 categories with tracked vulnerabilities, ranked by count.

Sort:
CWE-79 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
45,750
CVEs
CWE-89 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
19,988
CVEs
CWE-787 High
Out-of-bounds Write
14,406
CVEs
CWE-119 High
Improper Restriction of Operations within the Bounds of a Memory Buffer
14,073
CVEs
CWE-20 High
Improper Input Validation
12,831
CVEs
CWE-200 High
Exposure of Sensitive Information to an Unauthorized Actor
10,504
CVEs
CWE-22 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
9,570
CVEs
CWE-352 Medium
Cross-Site Request Forgery (CSRF)
9,488
CVEs
CWE-125
Out-of-bounds Read
9,159
CVEs
CWE-862 High
Missing Authorization
8,794
CVEs
CWE-416 High
Use After Free
8,051
CVEs
CWE-94 Medium
Improper Control of Generation of Code ('Code Injection')
6,710
CVEs
CWE-284
Improper Access Control
6,223
CVEs
CWE-78 High
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
6,220
CVEs
CWE-476 Medium
NULL Pointer Dereference
5,459
CVEs
CWE-74 High
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
4,983
CVEs
CWE-287 High
Improper Authentication
4,567
CVEs
CWE-120 High
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
4,334
CVEs
CWE-434 Medium
Unrestricted Upload of File with Dangerous Type
4,223
CVEs
CWE-77 High
Improper Neutralization of Special Elements used in a Command ('Command Injection')
3,629
CVEs
CWE-121 High
Stack-based Buffer Overflow
3,540
CVEs
CWE-400 High
Uncontrolled Resource Consumption
3,367
CVEs
CWE-863 High
Incorrect Authorization
3,359
CVEs
CWE-190 Medium
Integer Overflow or Wraparound
3,329
CVEs
CWE-269 Medium
Improper Privilege Management
3,089
CVEs
CWE-918
Server-Side Request Forgery (SSRF)
3,003
CVEs
CWE-502 Medium
Deserialization of Untrusted Data
2,987
CVEs
CWE-306 High
Missing Authentication for Critical Function
2,842
CVEs
CWE-122 High
Heap-based Buffer Overflow
2,559
CVEs
CWE-362 Medium
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
2,529
CVEs
CWE-639 High
Authorization Bypass Through User-Controlled Key
2,100
CVEs
CWE-770 High
Allocation of Resources Without Limits or Throttling
2,071
CVEs
CWE-401 Medium
Missing Release of Memory after Effective Lifetime
1,867
CVEs
CWE-798 High
Use of Hard-coded Credentials
1,752
CVEs
CWE-732 High
Incorrect Permission Assignment for Critical Resource
1,710
CVEs
CWE-601 Low
URL Redirection to Untrusted Site ('Open Redirect')
1,628
CVEs
CWE-59 Medium
Improper Link Resolution Before File Access ('Link Following')
1,612
CVEs
CWE-276 Medium
Incorrect Default Permissions
1,533
CVEs
CWE-285 High
Improper Authorization
1,461
CVEs
CWE-295
Improper Certificate Validation
1,453
CVEs
CWE-522
Insufficiently Protected Credentials
1,403
CVEs
CWE-611
Improper Restriction of XML External Entity Reference
1,277
CVEs
CWE-98 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
1,270
CVEs
CWE-427
Uncontrolled Search Path Element
1,191
CVEs
CWE-532 Medium
Insertion of Sensitive Information into Log File
1,169
CVEs
CWE-266
Incorrect Privilege Assignment
1,014
CVEs
CWE-319 High
Cleartext Transmission of Sensitive Information
898
CVEs
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
886
CVEs
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
847
CVEs
CWE-415 High
Double Free
823
CVEs
CWE-312
Cleartext Storage of Sensitive Information
817
CVEs
CWE-908 Medium
Use of Uninitialized Resource
811
CVEs
CWE-617
Reachable Assertion
794
CVEs
CWE-203
Observable Discrepancy
751
CVEs
CWE-404 Medium
Improper Resource Shutdown or Release
750
CVEs
CWE-347
Improper Verification of Cryptographic Signature
742
CVEs
CWE-668
Exposure of Resource to Wrong Sphere
732
CVEs
CWE-667
Improper Locking
722
CVEs
CWE-367 Medium
Time-of-check Time-of-use (TOCTOU) Race Condition
703
CVEs
CWE-327 High
Use of a Broken or Risky Cryptographic Algorithm
686
CVEs
CWE-346
Origin Validation Error
684
CVEs
CWE-693
Protection Mechanism Failure
668
CVEs
CWE-426 High
Untrusted Search Path
657
CVEs
CWE-345
Insufficient Verification of Data Authenticity
656
CVEs
CWE-290
Authentication Bypass by Spoofing
636
CVEs
CWE-288
Authentication Bypass Using an Alternate Path or Channel
612
CVEs
CWE-307
Improper Restriction of Excessive Authentication Attempts
607
CVEs
CWE-754 Medium
Improper Check for Unusual or Exceptional Conditions
605
CVEs
CWE-129 High
Improper Validation of Array Index
603
CVEs
CWE-755 Medium
Improper Handling of Exceptional Conditions
582
CVEs
CWE-209 High
Generation of Error Message Containing Sensitive Information
580
CVEs
CWE-613
Insufficient Session Expiration
575
CVEs
CWE-80 High
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
562
CVEs
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
539
CVEs
CWE-73 High
External Control of File Name or Path
519
CVEs
CWE-311 High
Missing Encryption of Sensitive Data
511
CVEs
CWE-191
Integer Underflow (Wrap or Wraparound)
502
CVEs
CWE-116 High
Improper Encoding or Escaping of Output
482
CVEs
CWE-552
Files or Directories Accessible to External Parties
482
CVEs
CWE-126
Buffer Over-read
477
CVEs
CWE-674
Uncontrolled Recursion
474
CVEs
CWE-772 High
Missing Release of Resource after Effective Lifetime
472
CVEs
CWE-23
Relative Path Traversal
461
CVEs
CWE-369 Medium
Divide By Zero
459
CVEs
CWE-1333 High
Inefficient Regular Expression Complexity
457
CVEs
CWE-326
Inadequate Encryption Strength
457
CVEs
CWE-428
Unquoted Search Path or Element
451
CVEs
CWE-384
Session Fixation
416
CVEs
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
401
CVEs
CWE-134 High
Use of Externally-Controlled Format String
399
CVEs
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
393
CVEs
CWE-330 High
Use of Insufficiently Random Values
381
CVEs
CWE-922
Insecure Storage of Sensitive Information
373
CVEs
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
370
CVEs
CWE-201
Insertion of Sensitive Information Into Sent Data
367
CVEs
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
367
CVEs
CWE-1284
Improper Validation of Specified Quantity in Input
364
CVEs
CWE-665 Medium
Improper Initialization
354
CVEs
CWE-250 Medium
Execution with Unnecessary Privileges
341
CVEs
CWE-281
Improper Preservation of Permissions
337
CVEs
CWE-451
User Interface (UI) Misrepresentation of Critical Information
332
CVEs
CWE-1188
Initialization of a Resource with an Insecure Default
312
CVEs
CWE-321 High
Use of Hard-coded Cryptographic Key
311
CVEs
CWE-640 High
Weak Password Recovery Mechanism for Forgotten Password
300
CVEs
CWE-1236
Improper Neutralization of Formula Elements in a CSV File
298
CVEs
CWE-829
Inclusion of Functionality from Untrusted Control Sphere
298
CVEs
CWE-824
Access of Uninitialized Pointer
291
CVEs
CWE-704
Incorrect Type Conversion or Cast
273
CVEs
CWE-521
Weak Password Requirements
260
CVEs
CWE-707
Improper Neutralization
252
CVEs
CWE-248
Uncaught Exception
242
CVEs
CWE-294 High
Authentication Bypass by Capture-replay
241
CVEs
CWE-610
Externally Controlled Reference to a Resource in Another Sphere
239
CVEs
CWE-425
Direct Request ('Forced Browsing')
235
CVEs
CWE-457 High
Use of Uninitialized Variable
227
CVEs
CWE-193
Off-by-one Error
218
CVEs
CWE-256 High
Plaintext Storage of a Password
215
CVEs
CWE-822
Untrusted Pointer Dereference
212
CVEs
CWE-494 Medium
Download of Code Without Integrity Check
211
CVEs
CWE-131 High
Incorrect Calculation of Buffer Size
209
CVEs
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
206
CVEs
CWE-338 Medium
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
205
CVEs
CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
196
CVEs
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
196
CVEs
CWE-259 High
Use of Hard-coded Password
195
CVEs
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
193
CVEs
CWE-459
Incomplete Cleanup
192
CVEs
CWE-789
Memory Allocation with Excessive Size Value
187
CVEs
CWE-749 Low
Exposed Dangerous Method or Function
178
CVEs
CWE-252 Low
Unchecked Return Value
174
CVEs
CWE-35
Path Traversal: '.../...//'
172
CVEs
CWE-354 Medium
Improper Validation of Integrity Check Value
171
CVEs
CWE-204
Observable Response Discrepancy
167
CVEs
CWE-184
Incomplete List of Disallowed Inputs
161
CVEs
CWE-697
Incorrect Comparison
161
CVEs
CWE-208
Observable Timing Discrepancy
159
CVEs
CWE-61 High
UNIX Symbolic Link (Symlink) Following
158
CVEs
CWE-280
Improper Handling of Insufficient Permissions or Privileges
155
CVEs
CWE-305
Authentication Bypass by Primary Weakness
154
CVEs
CWE-703
Improper Check or Handling of Exceptional Conditions
154
CVEs
CWE-602 Medium
Client-Side Enforcement of Server-Side Security
153
CVEs
CWE-95 Medium
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
152
CVEs
CWE-788
Access of Memory Location After End of Buffer
147
CVEs
CWE-1287
Improper Validation of Specified Type of Input
146
CVEs
CWE-670
Always-Incorrect Control Flow Implementation
142
CVEs
CWE-472
External Control of Assumed-Immutable Web Parameter
140
CVEs
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
138
CVEs
CWE-331
Insufficient Entropy
135
CVEs
CWE-358
Improperly Implemented Security Check for Standard
132
CVEs
CWE-91
XML Injection (aka Blind XPath Injection)
131
CVEs
CWE-36
Absolute Path Traversal
130
CVEs
CWE-682 High
Incorrect Calculation
130
CVEs
CWE-436
Interpretation Conflict
126
CVEs
CWE-407 Low
Inefficient Algorithmic Complexity
124
CVEs
CWE-681 High
Incorrect Conversion between Numeric Types
124
CVEs
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
119
CVEs
CWE-916
Use of Password Hash With Insufficient Computational Effort
119
CVEs
CWE-706
Use of Incorrectly-Resolved Name or Reference
116
CVEs
CWE-942
Permissive Cross-domain Security Policy with Untrusted Domains
114
CVEs
CWE-24
Path Traversal: '../filedir'
113
CVEs
CWE-441
Unintended Proxy or Intermediary ('Confused Deputy')
109
CVEs
CWE-834
Excessive Iteration
109
CVEs
CWE-1392
Use of Default Credentials
108
CVEs
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
107
CVEs
CWE-680
Integer Overflow to Buffer Overflow
105
CVEs
CWE-130
Improper Handling of Length Parameter Inconsistency
104
CVEs
CWE-117 Medium
Improper Output Neutralization for Logs
102
CVEs
CWE-909 Medium
Missing Initialization of Resource
102
CVEs
CWE-1220
Insufficient Granularity of Access Control
100
CVEs
CWE-823
Use of Out-of-range Pointer Offset
100
CVEs
CWE-669
Incorrect Resource Transfer Between Spheres
98
CVEs
CWE-763
Release of Invalid Pointer or Reference
98
CVEs
CWE-377
Insecure Temporary File
97
CVEs
CWE-303
Incorrect Implementation of Authentication Algorithm
96
CVEs
CWE-538
Insertion of Sensitive Information into Externally-Accessible File or Directory
92
CVEs
CWE-913
Improper Control of Dynamically-Managed Code Resources
92
CVEs
CWE-328
Use of Weak Hash
90
CVEs
CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)
89
CVEs
CWE-506
Embedded Malicious Code
89
CVEs
CWE-1286
Improper Validation of Syntactic Correctness of Input
88
CVEs
CWE-620
Unverified Password Change
88
CVEs
CWE-598
Use of HTTP Request With Sensitive Query String
87
CVEs
CWE-1390
Weak Authentication
86
CVEs
CWE-178
Improper Handling of Case Sensitivity
86
CVEs
CWE-489
Active Debug Code
86
CVEs
CWE-776 Medium
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
86
CVEs
CWE-825
Expired Pointer Dereference
86
CVEs
CWE-807 High
Reliance on Untrusted Inputs in a Security Decision
85
CVEs
CWE-672
Operation on a Resource after Expiration or Release
83
CVEs
CWE-926
Improper Export of Android Application Components
82
CVEs
CWE-912
Hidden Functionality
81
CVEs
CWE-591
Sensitive Data Storage in Improperly Locked Memory
77
CVEs
CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
76
CVEs
CWE-565
Reliance on Cookies without Validation and Integrity Checking
75
CVEs
CWE-90
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
73
CVEs
CWE-277
Insecure Inherited Permissions
71
CVEs
CWE-653
Improper Isolation or Compartmentalization
71
CVEs
CWE-799
Improper Control of Interaction Frequency
71
CVEs
CWE-15
External Control of System or Configuration Setting
70
CVEs
CWE-150
Improper Neutralization of Escape, Meta, or Control Sequences
68
CVEs