Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
774 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-193 | Off-by-one Error | Allowed | 247 |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | Allowed | 239 |
| CWE-1287 | Improper Validation of Specified Type of Input | Allowed | 239 |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | Allowed | 237 |
| CWE-35 | Path Traversal: '.../...//' | Allowed | 234 |
| CWE-1188 | Initialization of a Resource with an Insecure Default | Allowed | 232 |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | Allowed-with-Review | 230 |
| CWE-294 | Authentication Bypass by Capture-replay | Allowed | 228 |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Allowed | 225 |
| CWE-668 | Exposure of Resource to Wrong Sphere | Discouraged | 221 |
| CWE-407 | Inefficient Algorithmic Complexity | Allowed-with-Review | 221 |
| CWE-755 | Improper Handling of Exceptional Conditions | Discouraged | 220 |
| CWE-208 | Observable Timing Discrepancy | Allowed | 216 |
| CWE-204 | Observable Response Discrepancy | Allowed | 212 |
| CWE-824 | Access of Uninitialized Pointer | Allowed | 211 |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | Allowed-with-Review | 205 |
| CWE-326 | Inadequate Encryption Strength | Allowed-with-Review | 205 |
| CWE-203 | Observable Discrepancy | Allowed | 203 |
| CWE-256 | Plaintext Storage of a Password | Allowed | 200 |
| CWE-36 | Absolute Path Traversal | Allowed | 199 |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | Allowed | 197 |
| CWE-436 | Interpretation Conflict | Allowed-with-Review | 197 |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | Allowed | 190 |
| CWE-384 | Session Fixation | Allowed | 189 |
| CWE-1390 | Weak Authentication | Allowed-with-Review | 187 |
| CWE-305 | Authentication Bypass by Primary Weakness | Allowed | 182 |
| CWE-259 | Use of Hard-coded Password | Allowed | 181 |
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | Allowed | 179 |
| CWE-134 | Use of Externally-Controlled Format String | Allowed | 178 |
| CWE-330 | Use of Insufficiently Random Values | Discouraged | 173 |
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | Allowed-with-Review | 170 |
| CWE-369 | Divide By Zero | Allowed | 169 |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | Allowed | 166 |
| CWE-280 | Improper Handling of Insufficient Permissions or Privileges | Allowed | 162 |
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | Allowed | 159 |
| CWE-494 | Download of Code Without Integrity Check | Allowed | 157 |
| CWE-252 | Unchecked Return Value | Allowed | 155 |
| CWE-131 | Incorrect Calculation of Buffer Size | Allowed | 155 |
| CWE-681 | Incorrect Conversion between Numeric Types | Allowed | 154 |
| CWE-636 | Not Failing Securely ('Failing Open') | Allowed-with-Review | 154 |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | Allowed | 149 |
| CWE-459 | Incomplete Cleanup | Allowed | 148 |
| CWE-788 | Access of Memory Location After End of Buffer | Discouraged | 146 |
| CWE-602 | Client-Side Enforcement of Server-Side Security | Allowed-with-Review | 143 |
| CWE-325 | Missing Cryptographic Step | Allowed | 143 |
| CWE-358 | Improperly Implemented Security Check for Standard | Allowed | 137 |
| CWE-130 | Improper Handling of Length Parameter Inconsistency | Allowed | 137 |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | Allowed-with-Review | 136 |
| CWE-457 | Use of Uninitialized Variable | Allowed | 136 |