Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | Weakness | Allowed-with-Review | 374 |
| CWE-452 | Initialization and Cleanup Errors | Grouping | Prohibited | 0 |
| CWE-453 | Insecure Default Variable Initialization | Weakness | Allowed | 34 |
| CWE-454 | External Initialization of Trusted Variables or Data Stores | Weakness | Allowed | 7 |
| CWE-455 | Non-exit on Failed Initialization | Weakness | Allowed | 2 |
| CWE-456 | Missing Initialization of a Variable | Weakness | Allowed | 13 |
| CWE-457 | Use of Uninitialized Variable | Weakness | Allowed | 291 |
| CWE-458 | DEPRECATED: Incorrect Initialization | Weakness | Prohibited | 0 |
| CWE-459 | Incomplete Cleanup | Weakness | Allowed | 224 |
| CWE-460 | Improper Cleanup on Thrown Exception | Weakness | Allowed | 40 |
| CWE-461 | DEPRECATED: Data Structure Issues | Grouping | Prohibited | 0 |
| CWE-462 | Duplicate Key in Associative List (Alist) | Weakness | Allowed | 2 |
| CWE-463 | Deletion of Data Structure Sentinel | Weakness | Allowed | 4 |
| CWE-464 | Addition of Data Structure Sentinel | Weakness | Allowed | 0 |
| CWE-465 | Pointer Issues | Grouping | Prohibited | 2 |
| CWE-466 | Return of Pointer Value Outside of Expected Range | Weakness | Allowed | 15 |
| CWE-467 | Use of sizeof() on a Pointer Type | Weakness | Allowed | 3 |
| CWE-468 | Incorrect Pointer Scaling | Weakness | Allowed | 7 |
| CWE-469 | Use of Pointer Subtraction to Determine Size | Weakness | Allowed | 2 |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code | Weakness | Allowed | 109 |
| CWE-471 | Modification of Assumed-Immutable Data (MAID) | Weakness | Allowed | 69 |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | Weakness | Allowed | 186 |
| CWE-473 | PHP External Variable Modification | Weakness | Allowed | 7 |
| CWE-474 | Use of Function with Inconsistent Implementations | Weakness | Allowed | 12 |
| CWE-475 | Undefined Behavior for Input to API | Weakness | Allowed | 30 |
| CWE-476 | NULL Pointer Dereference | Weakness | Allowed | 6230 |
| CWE-477 | Use of Obsolete Function | Weakness | Allowed | 28 |
| CWE-478 | Missing Default Case in Multiple Condition Expression | Weakness | Allowed | 2 |
| CWE-479 | Signal Handler Use of a Non-reentrant Function | Weakness | Allowed | 3 |
| CWE-480 | Use of Incorrect Operator | Weakness | Allowed | 10 |
| CWE-481 | Assigning instead of Comparing | Weakness | Allowed | 0 |
| CWE-482 | Comparing instead of Assigning | Weakness | Allowed | 3 |
| CWE-483 | Incorrect Block Delimitation | Weakness | Allowed | 0 |
| CWE-484 | Omitted Break Statement in Switch | Weakness | Allowed | 3 |
| CWE-485 | 7PK - Encapsulation | Grouping | Prohibited | 1 |
| CWE-486 | Comparison of Classes by Name | Weakness | Allowed | 0 |
| CWE-487 | Reliance on Package-level Scope | Weakness | Allowed | 0 |
| CWE-488 | Exposure of Data Element to Wrong Session | Weakness | Allowed | 51 |
| CWE-489 | Active Debug Code | Weakness | Allowed | 134 |
| CWE-490 | DEPRECATED: Mobile Code Issues | Grouping | Prohibited | 0 |
| CWE-491 | Public cloneable() Method Without Final | Weakness | Allowed | 4 |
| CWE-492 | Use of Inner Class Containing Sensitive Data | Weakness | Allowed | 0 |
| CWE-493 | Critical Public Variable Without Final Modifier | Weakness | Allowed | 0 |
| CWE-494 | Download of Code Without Integrity Check | Weakness | Allowed | 293 |
| CWE-495 | Private Data Structure Returned From A Public Method | Weakness | Allowed | 2 |
| CWE-496 | Public Data Assigned to Private Array-Typed Field | Weakness | Allowed | 0 |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Weakness | Allowed | 659 |
| CWE-498 | Cloneable Class Containing Sensitive Information | Weakness | Allowed | 0 |
| CWE-499 | Serializable Class Containing Sensitive Data | Weakness | Allowed | 2 |
| CWE-500 | Public Static Field Not Marked Final | Weakness | Allowed | 0 |