Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
774 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-182 | Collapse of Data into Unsafe Value | Allowed | 3 |
| CWE-168 | Improper Handling of Inconsistent Special Elements | Allowed | 3 |
| CWE-1426 | Improper Validation of Generative AI Output | Discouraged | 3 |
| CWE-1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution | Allowed | 3 |
| CWE-1384 | Improper Handling of Physical or Environmental Conditions | Allowed-with-Review | 3 |
| CWE-1298 | Hardware Logic Contains Race Conditions | Allowed | 3 |
| CWE-1283 | Mutable Attestation or Measurement Reporting Data | Allowed | 3 |
| CWE-1280 | Access Control Check Implemented After Asset is Accessed | Allowed | 3 |
| CWE-1279 | Cryptographic Operations are run Before Supporting Units are Ready | Allowed | 3 |
| CWE-1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection | Allowed | 3 |
| CWE-1231 | Improper Prevention of Lock Bit Modification | Allowed | 3 |
| CWE-1119 | Excessive Use of Unconditional Branching | Prohibited | 3 |
| CWE-1049 | Excessive Data Query Operations in a Large Data Table | Allowed | 3 |
| CWE-85 | Doubled Character XSS Manipulations | Allowed | 2 |
| CWE-769 | DEPRECATED: Uncontrolled File Descriptor Consumption | Prohibited | 2 |
| CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | Allowed | 2 |
| CWE-689 | Permission Race Condition During Resource Copy | Allowed | 2 |
| CWE-675 | Multiple Operations on Resource in Single-Operation Context | Allowed-with-Review | 2 |
| CWE-655 | Insufficient Psychological Acceptability | Allowed-with-Review | 2 |
| CWE-637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') | Allowed-with-Review | 2 |
| CWE-624 | Executable Regular Expression Error | Allowed | 2 |
| CWE-622 | Improper Validation of Function Hook Arguments | Allowed | 2 |
| CWE-563 | Assignment to Variable without Use | Allowed | 2 |
| CWE-531 | Inclusion of Sensitive Information in Test Code | Allowed | 2 |
| CWE-528 | Exposure of Core Dump File to an Unauthorized Control Sphere | Allowed | 2 |
| CWE-499 | Serializable Class Containing Sensitive Data | Allowed | 2 |
| CWE-479 | Signal Handler Use of a Non-reentrant Function | Allowed | 2 |
| CWE-46 | Path Equivalence: 'filename ' (Trailing Space) | Allowed | 2 |
| CWE-450 | Multiple Interpretations of UI Input | Allowed | 2 |
| CWE-422 | Unprotected Windows Messaging Channel ('Shatter') | Allowed | 2 |
| CWE-396 | Declaration of Catch for Generic Exception | Allowed | 2 |
| CWE-360 | Trust of System Event Data | Allowed | 2 |
| CWE-339 | Small Seed Space in PRNG | Allowed | 2 |
| CWE-32 | Path Traversal: '...' (Triple Dot) | Allowed | 2 |
| CWE-224 | Obscured Security-relevant Information by Alternate Name | Allowed | 2 |
| CWE-221 | Information Loss or Omission | Allowed-with-Review | 2 |
| CWE-205 | Observable Behavioral Discrepancy | Allowed | 2 |
| CWE-186 | Overly Restrictive Regular Expression | Allowed | 2 |
| CWE-174 | Double Decoding of the Same Data | Allowed | 2 |
| CWE-164 | Improper Neutralization of Internal Special Elements | Allowed | 2 |
| CWE-157 | Failure to Sanitize Paired Delimiters | Allowed | 2 |
| CWE-145 | Improper Neutralization of Section Delimiters | Allowed | 2 |
| CWE-1428 | Reliance on HTTP instead of HTTPS | Allowed | 2 |
| CWE-135 | Incorrect Calculation of Multi-Byte String Length | Allowed | 2 |