Common Weakness Enumeration

Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.

Reset

774 CWEs

API response
CWE Name Mapping usage Occurrences
CWE-798 Use of Hard-coded Credentials Allowed-with-Review 784
CWE-197 Numeric Truncation Error Allowed 759
CWE-522 Insufficiently Protected Credentials Allowed-with-Review 738
CWE-732 Incorrect Permission Assignment for Critical Resource Allowed-with-Review 736
CWE-288 Authentication Bypass Using an Alternate Path or Channel Allowed 725
CWE-345 Insufficient Verification of Data Authenticity Discouraged 709
CWE-415 Double Free Allowed 708
CWE-276 Incorrect Default Permissions Allowed 685
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Allowed 604
CWE-346 Origin Validation Error Allowed-with-Review 600
CWE-404 Improper Resource Shutdown or Release Allowed-with-Review 597
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Allowed 575
CWE-611 Improper Restriction of XML External Entity Reference Allowed 533
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Allowed 513
CWE-290 Authentication Bypass by Spoofing Allowed 510
CWE-319 Cleartext Transmission of Sensitive Information Allowed 503
CWE-312 Cleartext Storage of Sensitive Information Allowed 491
CWE-1333 Inefficient Regular Expression Complexity Allowed 482
CWE-674 Uncontrolled Recursion Allowed-with-Review 476
CWE-307 Improper Restriction of Excessive Authentication Attempts Allowed 471
CWE-201 Insertion of Sensitive Information Into Sent Data Allowed 468
CWE-613 Insufficient Session Expiration Allowed-with-Review 464
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere Allowed 460
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Allowed 451
CWE-426 Untrusted Search Path Allowed-with-Review 450
CWE-754 Improper Check for Unusual or Exceptional Conditions Allowed-with-Review 447
CWE-829 Inclusion of Functionality from Untrusted Control Sphere Allowed 445
CWE-250 Execution with Unnecessary Privileges Allowed 439
CWE-248 Uncaught Exception Allowed 423
CWE-401 Missing Release of Memory after Effective Lifetime Allowed 422
CWE-1220 Insufficient Granularity of Access Control Allowed 421
CWE-209 Generation of Error Message Containing Sensitive Information Allowed 415
CWE-116 Improper Encoding or Escaping of Output Allowed-with-Review 414
CWE-789 Memory Allocation with Excessive Size Value Allowed 392
CWE-617 Reachable Assertion Allowed 388
CWE-327 Use of a Broken or Risky Cryptographic Algorithm Allowed-with-Review 378
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Allowed 375
CWE-428 Unquoted Search Path or Element Allowed 361
CWE-321 Use of Hard-coded Cryptographic Key Allowed 344
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor Allowed 342
CWE-1284 Improper Validation of Specified Quantity in Input Allowed 317
CWE-552 Files or Directories Accessible to External Parties Allowed 314
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') Allowed 295
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine Allowed 294
CWE-311 Missing Encryption of Sensitive Data Discouraged 291
CWE-129 Improper Validation of Array Index Allowed 279
CWE-749 Exposed Dangerous Method or Function Allowed 278
CWE-184 Incomplete List of Disallowed Inputs Allowed 257
CWE-707 Improper Neutralization Discouraged 252