CWE weakness classes

Browse CVEs grouped by CWE weakness class — the category of programming or design flaw behind each vulnerability, ranked by how many CVEs carry it.

Weakness classes by CVE count

CWE-79 — Cross-site Scripting — 47651 CVEs
CWE-89 — SQL Injection — 20952 CVEs
CWE-787 — Out-of-bounds Write — 14972 CVEs
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer — 14342 CVEs
CWE-20 — Improper Input Validation — 13340 CVEs
CWE-200 — Information Disclosure — 11220 CVEs
CWE-22 — Path Traversal — 10427 CVEs
CWE-862 — Missing Authorization — 10210 CVEs
CWE-125 — Out-of-bounds Read — 9844 CVEs
CWE-352 — Cross-Site Request Forgery (CSRF) — 9742 CVEs
CWE-416 — Use After Free — 8794 CVEs
CWE-284 — Improper Access Control — 8047 CVEs
CWE-94 — Code Injection — 7259 CVEs
CWE-78 — OS Command Injection — 6881 CVEs
CWE-476 — NULL Pointer Dereference — 5689 CVEs
CWE-264 — 5502 CVEs
CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) — 5469 CVEs
CWE-287 — Improper Authentication — 5008 CVEs
CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow) — 4494 CVEs
CWE-434 — Unrestricted Upload of File with Dangerous Type — 4446 CVEs
CWE-863 — Incorrect Authorization — 4141 CVEs
CWE-77 — Command Injection — 3896 CVEs
CWE-121 — Stack-based Buffer Overflow — 3847 CVEs
CWE-400 — Uncontrolled Resource Consumption — 3825 CVEs
CWE-918 — Server-Side Request Forgery (SSRF) — 3713 CVEs
CWE-269 — Improper Privilege Management — 3636 CVEs
CWE-190 — Integer Overflow or Wraparound — 3612 CVEs
CWE-306 — Missing Authentication for Critical Function — 3396 CVEs
CWE-502 — Deserialization of Untrusted Data — 3332 CVEs
CWE-122 — Heap-based Buffer Overflow — 3213 CVEs
CWE-639 — Authorization Bypass Through User-Controlled Key — 2825 CVEs
CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) — 2694 CVEs
CWE-399 — 2694 CVEs
CWE-310 — Cryptographic Issues — 2521 CVEs
CWE-770 — Allocation of Resources Without Limits or Throttling — 2465 CVEs
CWE-401 — Missing Release of Memory after Effective Lifetime — 1943 CVEs
CWE-798 — Use of Hard-coded Credentials — 1852 CVEs
CWE-732 — Incorrect Permission Assignment for Critical Resource — 1776 CVEs
CWE-59 — Improper Link Resolution Before File Access — 1757 CVEs
CWE-601 — URL Redirection to Untrusted Site (Open Redirect) — 1750 CVEs
CWE-285 — Improper Authorization — 1668 CVEs
CWE-295 — Improper Certificate Validation — 1605 CVEs
CWE-276 — Incorrect Default Permissions — 1565 CVEs
CWE-522 — Insufficiently Protected Credentials — 1513 CVEs
CWE-611 — Improper Restriction of XML External Entity Reference (XXE) — 1338 CVEs
CWE-98 — PHP Remote File Inclusion — 1310 CVEs
CWE-189 — 1269 CVEs
CWE-532 — Insertion of Sensitive Information into Log File — 1260 CVEs
CWE-427 — Uncontrolled Search Path Element — 1231 CVEs
CWE-266 — Incorrect Privilege Assignment — 1188 CVEs
CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop) — 955 CVEs
CWE-843 — Access of Resource Using Incompatible Type (Type Confusion) — 950 CVEs
CWE-319 — Cleartext Transmission of Sensitive Information — 942 CVEs
CWE-908 — Use of Uninitialized Resource — 912 CVEs
CWE-415 — Double Free — 891 CVEs
CWE-347 — Improper Verification of Cryptographic Signature — 884 CVEs
CWE-312 — Cleartext Storage of Sensitive Information — 874 CVEs
CWE-617 — Reachable Assertion — 860 CVEs
CWE-693 — Protection Mechanism Failure — 858 CVEs
CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition — 844 CVEs
CWE-404 — Improper Resource Shutdown or Release — 828 CVEs
CWE-345 — Insufficient Verification of Data Authenticity — 810 CVEs
CWE-203 — Observable Discrepancy — 795 CVEs
CWE-346 — Origin Validation Error — 794 CVEs
CWE-255 — 783 CVEs
CWE-668 — Exposure of Resource to Wrong Sphere — 752 CVEs
CWE-290 — Authentication Bypass by Spoofing — 746 CVEs
CWE-667 — Improper Locking — 740 CVEs
CWE-327 — Use of a Broken or Risky Cryptographic Algorithm — 718 CVEs
CWE-426 — Untrusted Search Path — 689 CVEs
CWE-73 — External Control of File Name or Path — 682 CVEs
CWE-288 — Authentication Bypass Using an Alternate Path or Channel — 680 CVEs
CWE-307 — Improper Restriction of Excessive Authentication Attempts — 669 CVEs
CWE-129 — Improper Validation of Array Index — 656 CVEs
CWE-754 — Improper Check for Unusual or Exceptional Conditions — 645 CVEs
CWE-613 — Insufficient Session Expiration — 640 CVEs
CWE-209 — Generation of Error Message Containing Sensitive Information — 627 CVEs
CWE-755 — Improper Handling of Exceptional Conditions — 598 CVEs
CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) — 598 CVEs
CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) — 595 CVEs
CWE-191 — Integer Underflow — 590 CVEs
CWE-674 — Uncontrolled Recursion — 572 CVEs
CWE-116 — Improper Encoding or Escaping of Output — 552 CVEs
CWE-126 — Buffer Over-read — 533 CVEs
CWE-311 — Missing Encryption of Sensitive Data — 520 CVEs
CWE-1333 — Inefficient Regular Expression Complexity — 518 CVEs
CWE-552 — Files or Directories Accessible to External Parties — 516 CVEs
CWE-23 — Relative Path Traversal — 515 CVEs
CWE-772 — Missing Release of Resource after Effective Lifetime — 495 CVEs
CWE-369 — Divide By Zero — 478 CVEs
CWE-326 — Inadequate Encryption Strength — 470 CVEs
CWE-88 — Argument Injection — 467 CVEs
CWE-428 — Unquoted Search Path or Element — 457 CVEs
CWE-384 — Session Fixation — 443 CVEs
CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) — 435 CVEs
CWE-1284 — Improper Validation of Specified Quantity in Input — 428 CVEs
CWE-1021 — Improper Restriction of Rendered UI Layers or Frames (Clickjacking) — 421 CVEs
CWE-201 — Insertion of Sensitive Information into Sent Data — 419 CVEs
CWE-254 — 414 CVEs
CWE-134 — Use of Externally-Controlled Format String — 413 CVEs
CWE-330 — Use of Insufficiently Random Values — 407 CVEs
CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere — 406 CVEs
CWE-451 — User Interface (UI) Misrepresentation of Critical Information — 405 CVEs
CWE-922 — 379 CVEs
CWE-250 — 378 CVEs
CWE-321 — Use of Hard-coded Cryptographic Key — 370 CVEs
CWE-665 — Improper Initialization — 359 CVEs
CWE-281 — Improper Preservation of Permissions — 348 CVEs
CWE-1188 — Initialization of a Resource with an Insecure Default — 347 CVEs
CWE-829 — Inclusion of Functionality from Untrusted Control Sphere — 343 CVEs
CWE-640 — Weak Password Recovery Mechanism for Forgotten Password — 328 CVEs
CWE-16 — 318 CVEs
CWE-1236 — Improper Neutralization of Formula Elements in a CSV File — 314 CVEs
CWE-248 — 304 CVEs
CWE-824 — Access of Uninitialized Pointer — 295 CVEs
CWE-294 — Authentication Bypass by Capture-replay — 286 CVEs
CWE-704 — Incorrect Type Conversion or Cast — 286 CVEs
CWE-521 — Weak Password Requirements — 263 CVEs
CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine — 260 CVEs
CWE-707 — 259 CVEs
CWE-789 — 257 CVEs
CWE-457 — 253 CVEs
CWE-822 — Untrusted Pointer Dereference — 253 CVEs
CWE-93 — CRLF Injection — 249 CVEs
CWE-610 — Externally Controlled Reference to a Resource in Another Sphere — 247 CVEs
CWE-425 — Direct Request (Forced Browsing) — 245 CVEs
CWE-193 — Off-by-one Error — 242 CVEs
CWE-494 — Download of Code Without Integrity Check — 241 CVEs
CWE-19 — 235 CVEs
CWE-131 — Incorrect Calculation of Buffer Size — 232 CVEs
CWE-459 — Incomplete Cleanup — 227 CVEs
CWE-256 — Plaintext Storage of a Password — 225 CVEs
CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) — 216 CVEs
CWE-184 — Incomplete List of Disallowed Inputs — 215 CVEs
CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor — 215 CVEs
CWE-259 — Use of Hard-coded Password — 214 CVEs
CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) — 208 CVEs
CWE-95 — Eval Injection — 203 CVEs
CWE-749 — 199 CVEs
CWE-208 — 196 CVEs
CWE-204 — Observable Response Discrepancy — 193 CVEs
CWE-407 — Inefficient Algorithmic Complexity — 192 CVEs
CWE-354 — Improper Validation of Integrity Check Value — 191 CVEs
CWE-252 — 189 CVEs
CWE-697 — Incorrect Comparison — 187 CVEs
CWE-35 — Path Traversal: '.../...//' — 185 CVEs
CWE-61 — UNIX Symbolic Link (Symlink) Following — 177 CVEs
CWE-602 — 176 CVEs
CWE-703 — 174 CVEs
CWE-280 — Improper Handling of Insufficient Permissions or Privileges — 172 CVEs
CWE-305 — Authentication Bypass by Primary Weakness — 172 CVEs
CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes — 172 CVEs
CWE-441 — Unintended Proxy or Intermediary (Confused Deputy) — 171 CVEs
CWE-17 — 166 CVEs
CWE-1287 — 161 CVEs
CWE-472 — 155 CVEs
CWE-670 — Always-Incorrect Control Flow Implementation — 153 CVEs
CWE-436 — 152 CVEs
CWE-331 — Insufficient Entropy — 147 CVEs
CWE-788 — 147 CVEs
CWE-91 — XML Injection (Blind XPath Injection) — 147 CVEs
CWE-36 — Absolute Path Traversal — 144 CVEs
CWE-706 — Use of Incorrectly-Resolved Name or Reference — 144 CVEs
CWE-682 — Incorrect Calculation — 143 CVEs
CWE-681 — Incorrect Conversion between Numeric Types — 141 CVEs
CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification) — 139 CVEs
CWE-942 — Permissive Cross-domain Policy with Untrusted Domains — 135 CVEs
CWE-358 — 132 CVEs
CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer — 131 CVEs
CWE-916 — Use of Password Hash With Insufficient Computational Effort — 131 CVEs
CWE-117 — Improper Output Neutralization for Logs — 124 CVEs
CWE-113 — HTTP Response Splitting — 122 CVEs
CWE-24 — 121 CVEs
CWE-834 — Excessive Iteration — 120 CVEs
CWE-1392 — 119 CVEs
CWE-178 — Improper Handling of Case Sensitivity — 119 CVEs
CWE-130 — Improper Handling of Length Parameter Inconsistency — 118 CVEs
CWE-669 — Incorrect Resource Transfer Between Spheres — 117 CVEs
CWE-1220 — 116 CVEs
CWE-275 — Permission Issues — 115 CVEs
CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection) — 115 CVEs
CWE-943 — Improper Neutralization of Special Elements in Data Query Logic — 115 CVEs
CWE-807 — 114 CVEs
CWE-680 — Integer Overflow to Buffer Overflow — 112 CVEs
CWE-303 — Incorrect Implementation of Authentication Algorithm — 111 CVEs
CWE-913 — Improper Control of Dynamically-Managed Code Resources — 109 CVEs
CWE-377 — Insecure Temporary File — 108 CVEs
CWE-763 — Release of Invalid Pointer or Reference — 108 CVEs
CWE-823 — 106 CVEs
CWE-506 — 102 CVEs
CWE-909 — 102 CVEs
CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory — 100 CVEs
CWE-620 — 100 CVEs
CWE-840 — 99 CVEs
CWE-1286 — 98 CVEs
CWE-1390 — Weak Authentication — 98 CVEs
CWE-489 — Active Debug Code — 98 CVEs
CWE-598 — 98 CVEs
CWE-926 — 98 CVEs
CWE-320 — 95 CVEs
CWE-672 — Operation on a Resource after Expiration or Release — 94 CVEs
CWE-776 — Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion) — 94 CVEs
CWE-328 — Use of Weak Hash — 93 CVEs
CWE-825 — 93 CVEs
CWE-90 — LDAP Injection — 93 CVEs
CWE-912 — Hidden Functionality — 88 CVEs
CWE-150 — 85 CVEs
CWE-297 — Improper Validation of Certificate with Host Mismatch — 84 CVEs
CWE-348 — 83 CVEs
CWE-799 — 83 CVEs
CWE-15 — 82 CVEs
CWE-197 — 81 CVEs
CWE-565 — Reliance on Cookies without Validation and Integrity Checking — 80 CVEs
CWE-653 — 79 CVEs
CWE-841 — Improper Enforcement of Behavioral Workflow — 79 CVEs
CWE-923 — 78 CVEs
CWE-591 — 77 CVEs
CWE-524 — Use of Cache Containing Sensitive Information — 72 CVEs
CWE-277 — Insecure Inherited Permissions — 71 CVEs
CWE-267 — Privilege Defined With Unsafe Actions — 69 CVEs
CWE-257 — Storing Passwords in a Recoverable Format — 68 CVEs
CWE-648 — 68 CVEs
CWE-379 — Creation of Temporary File in Directory with Insecure Permissions — 66 CVEs
CWE-614 — Sensitive Cookie in HTTPS Session Without 'Secure' Attribute — 65 CVEs
CWE-29 — 64 CVEs
CWE-644 — Improper Neutralization of HTTP Headers for Scripting Syntax — 64 CVEs
CWE-99 — Resource Injection — 64 CVEs
CWE-123 — Write-what-where Condition — 63 CVEs
CWE-325 — Missing Cryptographic Step — 63 CVEs
CWE-636 — 63 CVEs
CWE-940 — Improper Verification of Source of a Communication Channel — 62 CVEs
CWE-1285 — 61 CVEs
CWE-1391 — 60 CVEs
CWE-300 — Channel Accessible by Non-Endpoint — 60 CVEs
CWE-548 — 60 CVEs
CWE-662 — Improper Synchronization — 60 CVEs
CWE-170 — Improper Null Termination — 57 CVEs
CWE-805 — Buffer Access with Incorrect Length Value — 57 CVEs
CWE-87 — Improper Neutralization of Alternate XSS Syntax — 57 CVEs
CWE-340 — 56 CVEs
CWE-405 — Asymmetric Resource Consumption (Amplification) — 56 CVEs
CWE-664 — 54 CVEs
CWE-183 — 49 CVEs
CWE-353 — 49 CVEs
CWE-378 — Creation of Temporary File With Insecure Permissions — 49 CVEs
CWE-323 — Reusing a Nonce, Key Pair in Encryption — 48 CVEs
CWE-349 — 48 CVEs
CWE-782 — 48 CVEs
CWE-289 — 47 CVEs
CWE-1393 — 46 CVEs
CWE-440 — Expected Behavior Violation — 46 CVEs
CWE-606 — 46 CVEs
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag — 45 CVEs
CWE-273 — Improper Check for Dropped Privileges — 45 CVEs
CWE-696 — 45 CVEs
CWE-1289 — 44 CVEs
CWE-261 — Weak Encoding for Password — 44 CVEs
CWE-302 — Authentication Bypass by Assumed-Immutable Data — 44 CVEs
CWE-304 — Missing Critical Step in Authentication — 44 CVEs
CWE-185 — Incorrect Regular Expression — 43 CVEs
CWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) — 43 CVEs
CWE-385 — 43 CVEs
CWE-388 — 43 CVEs
CWE-791 — 43 CVEs
CWE-1385 — 42 CVEs
CWE-274 — Improper Handling of Insufficient Privileges — 42 CVEs
CWE-488 — 42 CVEs
CWE-124 — Buffer Underwrite — 41 CVEs
CWE-202 — 41 CVEs
CWE-272 — 41 CVEs
CWE-316 — 41 CVEs
CWE-471 — Modification of Assumed-Immutable Data (MAID) — 41 CVEs
CWE-420 — Unprotected Alternate Channel — 40 CVEs
CWE-424 — 40 CVEs
CWE-924 — Improper Enforcement of Message Integrity During Transmission in a Communication Channel — 39 CVEs
CWE-226 — Sensitive Information in Resource Not Removed Before Reuse — 37 CVEs
CWE-757 — 37 CVEs
CWE-1300 — 36 CVEs
CWE-180 — 36 CVEs
CWE-691 — 36 CVEs
CWE-75 — 36 CVEs
CWE-778 — 36 CVEs
CWE-1288 — 35 CVEs
CWE-1395 — 35 CVEs
CWE-176 — 35 CVEs
CWE-214 — 35 CVEs
CWE-241 — 35 CVEs
CWE-501 — Trust Boundary Violation — 35 CVEs
CWE-540 — 35 CVEs
CWE-350 — 34 CVEs
CWE-92 — 34 CVEs
CWE-213 — 33 CVEs
CWE-356 — 33 CVEs
CWE-41 — 33 CVEs
CWE-690 — 33 CVEs
CWE-283 — 32 CVEs
CWE-286 — 32 CVEs
CWE-313 — Cleartext Storage in a File or on Disk — 32 CVEs
CWE-115 — 31 CVEs
CWE-1275 — 31 CVEs
CWE-233 — 31 CVEs
CWE-525 — 31 CVEs
CWE-1104 — 30 CVEs
CWE-27 — 30 CVEs
CWE-282 — 30 CVEs
CWE-83 — Improper Neutralization of Script in Attributes in a Web Page — 30 CVEs
CWE-158 — 29 CVEs
CWE-195 — 29 CVEs
CWE-322 — Key Exchange without Entity Authentication — 29 CVEs
CWE-684 — 29 CVEs
CWE-1327 — 28 CVEs
CWE-758 — 28 CVEs
CWE-939 — 28 CVEs
CWE-114 — Process Control — 27 CVEs
CWE-551 — 27 CVEs
CWE-833 — 27 CVEs
CWE-1191 — 26 CVEs
CWE-1230 — 26 CVEs
CWE-270 — Privilege Context Switching Error — 26 CVEs
CWE-279 — Incorrect Execution-Assigned Permissions — 26 CVEs
CWE-391 — 26 CVEs
CWE-460 — 26 CVEs
CWE-523 — Unprotected Transport of Credentials — 26 CVEs
CWE-603 — 26 CVEs
CWE-96 — Improper Neutralization of Directives in Statically Saved Code (Static Code Injection) — 26 CVEs
CWE-118 — Incorrect Access of Indexable Resource ('Range Error') — 25 CVEs
CWE-253 — 25 CVEs
CWE-260 — 25 CVEs
CWE-592 — 24 CVEs
CWE-1325 — 23 CVEs
CWE-215 — Insertion of Sensitive Information Into Debugging Code — 23 CVEs
CWE-402 — 23 CVEs
CWE-1240 — 22 CVEs
CWE-1295 — 22 CVEs
CWE-268 — Privilege Chaining — 22 CVEs
CWE-324 — Use of a Key Past its Expiration Date — 22 CVEs
CWE-390 — 22 CVEs
CWE-590 — 22 CVEs
CWE-759 — 22 CVEs
CWE-84 — 22 CVEs
CWE-1023 — 21 CVEs
CWE-228 — 21 CVEs
CWE-229 — 21 CVEs
CWE-244 — 21 CVEs
CWE-406 — 21 CVEs
CWE-410 — 21 CVEs
CWE-708 — 21 CVEs
CWE-779 — 21 CVEs
CWE-1025 — 20 CVEs
CWE-140 — 20 CVEs
CWE-341 — 20 CVEs
CWE-357 — 20 CVEs
CWE-364 — Signal Handler Race Condition — 20 CVEs
CWE-366 — Race Condition within a Thread — 20 CVEs
CWE-453 — 20 CVEs
CWE-526 — 20 CVEs
CWE-625 — 20 CVEs
CWE-642 — 20 CVEs
CWE-783 — 20 CVEs
CWE-155 — 19 CVEs
CWE-172 — 19 CVEs
CWE-296 — Improper Following of a Certificate's Chain of Trust — 19 CVEs
CWE-657 — 19 CVEs
CWE-698 — 19 CVEs
CWE-911 — 19 CVEs
CWE-1050 — 18 CVEs
CWE-1259 — 18 CVEs
CWE-1394 — 18 CVEs
CWE-26 — 18 CVEs
CWE-641 — Improper Restriction of Names for Files and Other Resources — 18 CVEs
CWE-804 — 18 CVEs
CWE-837 — 18 CVEs
CWE-927 — 18 CVEs
CWE-1260 — 17 CVEs
CWE-177 — 17 CVEs
CWE-299 — Improper Check for Certificate Revocation — 17 CVEs
CWE-308 — Use of Single-factor Authentication — 17 CVEs
CWE-395 — 17 CVEs
CWE-836 — 17 CVEs
CWE-838 — 17 CVEs
CWE-1258 — 16 CVEs
CWE-187 — Partial String Comparison — 16 CVEs
CWE-394 — 16 CVEs
CWE-413 — 16 CVEs
CWE-475 — 16 CVEs
CWE-477 — 16 CVEs
CWE-549 — 16 CVEs
CWE-820 — 16 CVEs
CWE-1242 — 15 CVEs
CWE-1263 — 15 CVEs
CWE-1386 — 15 CVEs
CWE-351 — 15 CVEs
CWE-417 — 15 CVEs
CWE-643 — Improper Neutralization of Data within XPath Expressions (XPath Injection) — 15 CVEs
CWE-76 — 15 CVEs
CWE-790 — 15 CVEs
CWE-138 — 14 CVEs
CWE-329 — Generation of Predictable IV with CBC Mode — 14 CVEs
CWE-334 — 14 CVEs
CWE-337 — 14 CVEs
CWE-449 — 14 CVEs
CWE-474 — 14 CVEs
CWE-599 — 14 CVEs
CWE-647 — 14 CVEs
CWE-821 — 14 CVEs
CWE-1022 — Use of Web Link to Untrusted Target with window.opener Access — 13 CVEs
CWE-1035 — 13 CVEs
CWE-1244 — 13 CVEs
CWE-159 — 13 CVEs
CWE-25 — 13 CVEs
CWE-265 — 13 CVEs
CWE-363 — Race Condition Enabling Link Following — 13 CVEs
CWE-564 — 13 CVEs
CWE-650 — Trusting HTTP Permission Methods on the Server Side — 13 CVEs
CWE-762 — 13 CVEs
CWE-830 — 13 CVEs
CWE-1241 — 12 CVEs
CWE-1262 — 12 CVEs
CWE-141 — 12 CVEs
CWE-223 — 12 CVEs
CWE-230 — 12 CVEs
CWE-258 — 12 CVEs
CWE-271 — Privilege Dropping / Lowering Errors — 12 CVEs
CWE-392 — 12 CVEs
CWE-419 — Unprotected Primary Channel — 12 CVEs
CWE-530 — 12 CVEs
CWE-694 — Use of Multiple Resources with Duplicate Identifier — 12 CVEs
CWE-701 — 12 CVEs
CWE-842 — 12 CVEs
CWE-232 — 11 CVEs
CWE-242 — 11 CVEs
CWE-291 — Reliance on IP Address for Authentication — 11 CVEs
CWE-31 — 11 CVEs
CWE-547 — Use of Hard-coded, Security-relevant Constants — 11 CVEs
CWE-567 — 11 CVEs
CWE-612 — 11 CVEs
CWE-656 — 11 CVEs
CWE-676 — 11 CVEs
CWE-760 — 11 CVEs
CWE-826 — 11 CVEs
CWE-86 — 11 CVEs
CWE-941 — 11 CVEs
CWE-1270 — 10 CVEs
CWE-1299 — 10 CVEs
CWE-14 — 10 CVEs
CWE-146 — 10 CVEs
CWE-332 — 10 CVEs
CWE-393 — 10 CVEs
CWE-480 — 10 CVEs
CWE-616 — 10 CVEs
CWE-646 — 10 CVEs
CWE-692 — 10 CVEs
CWE-705 — 10 CVEs
CWE-1173 — 9 CVEs
CWE-1274 — 9 CVEs
CWE-1326 — 9 CVEs
CWE-1357 — 9 CVEs
CWE-371 — 9 CVEs
CWE-372 — 9 CVEs
CWE-561 — 9 CVEs
CWE-566 — Authorization Bypass Through User-Controlled SQL Primary Key — 9 CVEs
CWE-573 — 9 CVEs
CWE-64 — 9 CVEs
CWE-733 — 9 CVEs
CWE-786 — 9 CVEs
CWE-81 — 9 CVEs
CWE-921 — 9 CVEs
CWE-112 — 8 CVEs
CWE-127 — Buffer Under-read — 8 CVEs
CWE-1282 — 8 CVEs