Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
774 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | Allowed | 4 |
| CWE-473 | PHP External Variable Modification | Allowed | 4 |
| CWE-467 | Use of sizeof() on a Pointer Type | Allowed | 4 |
| CWE-455 | Non-exit on Failed Initialization | Allowed | 4 |
| CWE-414 | Missing Lock Check | Allowed | 4 |
| CWE-368 | Context Switching Race Condition | Allowed | 4 |
| CWE-336 | Same Seed in Pseudo-Random Number Generator (PRNG) | Allowed | 4 |
| CWE-240 | Improper Handling of Inconsistent Structural Elements | Allowed | 4 |
| CWE-231 | Improper Handling of Extra Values | Allowed | 4 |
| CWE-216 | DEPRECATED: Containment Errors (Container Errors) | Prohibited | 4 |
| CWE-194 | Unexpected Sign Extension | Allowed | 4 |
| CWE-166 | Improper Handling of Missing Special Element | Allowed | 4 |
| CWE-156 | Improper Neutralization of Whitespace | Allowed | 4 |
| CWE-148 | Improper Neutralization of Input Leaders | Allowed | 4 |
| CWE-144 | Improper Neutralization of Line Delimiters | Allowed | 4 |
| CWE-1420 | Exposure of Sensitive Information during Transient Execution | Allowed-with-Review | 4 |
| CWE-142 | Improper Neutralization of Value Delimiters | Allowed | 4 |
| CWE-1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) | Allowed | 4 |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | Allowed | 4 |
| CWE-1234 | Hardware Internal or Debug Modes Allow Override of Locks | Allowed | 4 |
| CWE-1125 | Excessive Attack Surface | Prohibited | 4 |
| CWE-1108 | Excessive Reliance on Global Variables | Allowed | 4 |
| CWE-1068 | Inconsistency Between Implementation and Documented Design | Prohibited | 4 |
| CWE-1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism | Allowed-with-Review | 4 |
| CWE-1037 | Processor Optimization Removal or Modification of Security-critical Code | Allowed | 4 |
| CWE-925 | Improper Verification of Intent by Broadcast Receiver | Allowed | 3 |
| CWE-910 | Use of Expired File Descriptor | Allowed | 3 |
| CWE-780 | Use of RSA Algorithm without OAEP | Allowed | 3 |
| CWE-756 | Missing Custom Error Page | Allowed | 3 |
| CWE-687 | Function Call With Incorrectly Specified Argument Value | Allowed | 3 |
| CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | Allowed | 3 |
| CWE-62 | UNIX Hard Link | Allowed | 3 |
| CWE-605 | Multiple Binds to the Same Port | Allowed | 3 |
| CWE-597 | Use of Wrong Operator in String Comparison | Allowed | 3 |
| CWE-588 | Attempt to Access Child of a Non-structure Pointer | Allowed | 3 |
| CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | Prohibited | 3 |
| CWE-50 | Path Equivalence: '//multiple/leading/slash' | Allowed | 3 |
| CWE-474 | Use of Function with Inconsistent Implementations | Allowed | 3 |
| CWE-468 | Incorrect Pointer Scaling | Allowed | 3 |
| CWE-447 | Unimplemented or Unsupported Feature in UI | Allowed | 3 |
| CWE-446 | UI Discrepancy for Security Feature | Allowed-with-Review | 3 |
| CWE-437 | Incomplete Model of Endpoint Features | Allowed | 3 |
| CWE-435 | Improper Interaction Between Multiple Correctly-Behaving Entities | Discouraged | 3 |
| CWE-344 | Use of Invariant Value in Dynamically Changing Context | Allowed | 3 |
| CWE-239 | Failure to Handle Incomplete Element | Allowed | 3 |
| CWE-237 | Improper Handling of Structural Elements | Allowed | 3 |
| CWE-236 | Improper Handling of Undefined Parameters | Allowed | 3 |