CWE weakness classes

Browse CVEs grouped by CWE weakness class — the category of programming or design flaw behind each vulnerability, ranked by how many CVEs carry it.

Weakness classes by CVE count

CWE-79 — Cross-site Scripting — 46093 CVEs
CWE-89 — SQL Injection — 20222 CVEs
CWE-787 — Out-of-bounds Write — 14516 CVEs
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer — 14114 CVEs
CWE-20 — Improper Input Validation — 12950 CVEs
CWE-200 — Information Disclosure — 10639 CVEs
CWE-22 — Path Traversal — 9785 CVEs
CWE-352 — Cross-Site Request Forgery (CSRF) — 9550 CVEs
CWE-125 — Out-of-bounds Read — 9308 CVEs
CWE-862 — Missing Authorization — 9113 CVEs
CWE-416 — Use After Free — 8184 CVEs
CWE-94 — Code Injection — 6822 CVEs
CWE-78 — OS Command Injection — 6379 CVEs
CWE-284 — Improper Access Control — 6366 CVEs
CWE-476 — NULL Pointer Dereference — 5520 CVEs
CWE-264 — 5490 CVEs
CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) — 5072 CVEs
CWE-287 — Improper Authentication — 4667 CVEs
CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow) — 4357 CVEs
CWE-434 — Unrestricted Upload of File with Dangerous Type — 4272 CVEs
CWE-77 — Command Injection — 3703 CVEs
CWE-121 — Stack-based Buffer Overflow — 3617 CVEs
CWE-863 — Incorrect Authorization — 3519 CVEs
CWE-400 — Uncontrolled Resource Consumption — 3436 CVEs
CWE-190 — Integer Overflow or Wraparound — 3386 CVEs
CWE-269 — Improper Privilege Management — 3169 CVEs
CWE-918 — Server-Side Request Forgery (SSRF) — 3166 CVEs
CWE-502 — Deserialization of Untrusted Data — 3058 CVEs
CWE-306 — Missing Authentication for Critical Function — 2933 CVEs
CWE-399 — 2694 CVEs
CWE-122 — Heap-based Buffer Overflow — 2685 CVEs
CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) — 2566 CVEs
CWE-310 — Cryptographic Issues — 2514 CVEs
CWE-639 — Authorization Bypass Through User-Controlled Key — 2265 CVEs
CWE-770 — Allocation of Resources Without Limits or Throttling — 2168 CVEs
CWE-401 — Missing Release of Memory after Effective Lifetime — 1882 CVEs
CWE-798 — Use of Hard-coded Credentials — 1776 CVEs
CWE-732 — Incorrect Permission Assignment for Critical Resource — 1723 CVEs
CWE-59 — Improper Link Resolution Before File Access — 1658 CVEs
CWE-601 — URL Redirection to Untrusted Site (Open Redirect) — 1653 CVEs
CWE-276 — Incorrect Default Permissions — 1544 CVEs
CWE-285 — Improper Authorization — 1496 CVEs
CWE-295 — Improper Certificate Validation — 1483 CVEs
CWE-522 — Insufficiently Protected Credentials — 1423 CVEs
CWE-611 — Improper Restriction of XML External Entity Reference (XXE) — 1289 CVEs
CWE-98 — PHP Remote File Inclusion — 1276 CVEs
CWE-189 — 1247 CVEs
CWE-427 — Uncontrolled Search Path Element — 1208 CVEs
CWE-532 — Insertion of Sensitive Information into Log File — 1185 CVEs
CWE-266 — Incorrect Privilege Assignment — 1061 CVEs
CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop) — 902 CVEs
CWE-319 — Cleartext Transmission of Sensitive Information — 900 CVEs
CWE-843 — Access of Resource Using Incompatible Type (Type Confusion) — 864 CVEs
CWE-415 — Double Free — 836 CVEs
CWE-312 — Cleartext Storage of Sensitive Information — 829 CVEs
CWE-908 — Use of Uninitialized Resource — 829 CVEs
CWE-617 — Reachable Assertion — 804 CVEs
CWE-347 — Improper Verification of Cryptographic Signature — 783 CVEs
CWE-255 — 782 CVEs
CWE-203 — Observable Discrepancy — 758 CVEs
CWE-404 — Improper Resource Shutdown or Release — 756 CVEs
CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition — 737 CVEs
CWE-668 — Exposure of Resource to Wrong Sphere — 734 CVEs
CWE-667 — Improper Locking — 726 CVEs
CWE-346 — Origin Validation Error — 718 CVEs
CWE-693 — Protection Mechanism Failure — 708 CVEs
CWE-345 — Insufficient Verification of Data Authenticity — 702 CVEs
CWE-327 — Use of a Broken or Risky Cryptographic Algorithm — 695 CVEs
CWE-426 — Untrusted Search Path — 668 CVEs
CWE-290 — Authentication Bypass by Spoofing — 662 CVEs
CWE-288 — Authentication Bypass Using an Alternate Path or Channel — 628 CVEs
CWE-754 — Improper Check for Unusual or Exceptional Conditions — 623 CVEs
CWE-307 — Improper Restriction of Excessive Authentication Attempts — 620 CVEs
CWE-129 — Improper Validation of Array Index — 614 CVEs
CWE-209 — Generation of Error Message Containing Sensitive Information — 588 CVEs
CWE-613 — Insufficient Session Expiration — 588 CVEs
CWE-755 — Improper Handling of Exceptional Conditions — 584 CVEs
CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) — 566 CVEs
CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) — 554 CVEs
CWE-73 — External Control of File Name or Path — 547 CVEs
CWE-191 — Integer Underflow — 529 CVEs
CWE-311 — Missing Encryption of Sensitive Data — 513 CVEs
CWE-674 — Uncontrolled Recursion — 498 CVEs
CWE-116 — Improper Encoding or Escaping of Output — 493 CVEs
CWE-126 — Buffer Over-read — 493 CVEs
CWE-552 — Files or Directories Accessible to External Parties — 486 CVEs
CWE-772 — Missing Release of Resource after Effective Lifetime — 480 CVEs
CWE-23 — Relative Path Traversal — 474 CVEs
CWE-1333 — Inefficient Regular Expression Complexity — 468 CVEs
CWE-369 — Divide By Zero — 466 CVEs
CWE-326 — Inadequate Encryption Strength — 460 CVEs
CWE-428 — Unquoted Search Path or Element — 453 CVEs
CWE-384 — Session Fixation — 418 CVEs
CWE-254 — 414 CVEs
CWE-1021 — Improper Restriction of Rendered UI Layers or Frames (Clickjacking) — 405 CVEs
CWE-88 — Argument Injection — 404 CVEs
CWE-134 — Use of Externally-Controlled Format String — 400 CVEs
CWE-330 — Use of Insufficiently Random Values — 386 CVEs
CWE-201 — Insertion of Sensitive Information into Sent Data — 383 CVEs
CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) — 382 CVEs
CWE-1284 — Improper Validation of Specified Quantity in Input — 376 CVEs
CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere — 376 CVEs
CWE-922 — 376 CVEs
CWE-665 — Improper Initialization — 356 CVEs
CWE-250 — 352 CVEs
CWE-451 — User Interface (UI) Misrepresentation of Critical Information — 347 CVEs
CWE-281 — Improper Preservation of Permissions — 339 CVEs
CWE-321 — Use of Hard-coded Cryptographic Key — 327 CVEs
CWE-1188 — Initialization of a Resource with an Insecure Default — 319 CVEs
CWE-16 — 318 CVEs
CWE-829 — Inclusion of Functionality from Untrusted Control Sphere — 312 CVEs
CWE-640 — Weak Password Recovery Mechanism for Forgotten Password — 310 CVEs
CWE-1236 — Improper Neutralization of Formula Elements in a CSV File — 302 CVEs
CWE-824 — Access of Uninitialized Pointer — 291 CVEs
CWE-704 — Incorrect Type Conversion or Cast — 278 CVEs
CWE-521 — Weak Password Requirements — 261 CVEs
CWE-707 — 253 CVEs
CWE-248 — 250 CVEs
CWE-294 — Authentication Bypass by Capture-replay — 249 CVEs
CWE-610 — Externally Controlled Reference to a Resource in Another Sphere — 239 CVEs
CWE-425 — Direct Request (Forced Browsing) — 237 CVEs
CWE-19 — 235 CVEs
CWE-457 — 233 CVEs
CWE-822 — Untrusted Pointer Dereference — 223 CVEs
CWE-193 — Off-by-one Error — 220 CVEs
CWE-494 — Download of Code Without Integrity Check — 216 CVEs
CWE-256 — Plaintext Storage of a Password — 215 CVEs
CWE-789 — 215 CVEs
CWE-131 — Incorrect Calculation of Buffer Size — 212 CVEs
CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine — 210 CVEs
CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) — 209 CVEs
CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) — 206 CVEs
CWE-93 — CRLF Injection — 205 CVEs
CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor — 199 CVEs
CWE-459 — Incomplete Cleanup — 199 CVEs
CWE-259 — Use of Hard-coded Password — 198 CVEs
CWE-749 — 183 CVEs
CWE-35 — Path Traversal: '.../...//' — 177 CVEs
CWE-354 — Improper Validation of Integrity Check Value — 177 CVEs
CWE-252 — 175 CVEs
CWE-204 — Observable Response Discrepancy — 174 CVEs
CWE-184 — Incomplete List of Disallowed Inputs — 172 CVEs
CWE-208 — 169 CVEs
CWE-17 — 166 CVEs
CWE-95 — Eval Injection — 166 CVEs
CWE-602 — 163 CVEs
CWE-697 — Incorrect Comparison — 163 CVEs
CWE-61 — UNIX Symbolic Link (Symlink) Following — 162 CVEs
CWE-280 — Improper Handling of Insufficient Permissions or Privileges — 158 CVEs
CWE-305 — Authentication Bypass by Primary Weakness — 157 CVEs
CWE-703 — 157 CVEs
CWE-1287 — 150 CVEs
CWE-788 — 147 CVEs
CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes — 146 CVEs
CWE-472 — 145 CVEs
CWE-670 — Always-Incorrect Control Flow Implementation — 145 CVEs
CWE-331 — Insufficient Entropy — 140 CVEs
CWE-407 — Inefficient Algorithmic Complexity — 136 CVEs
CWE-436 — 135 CVEs
CWE-36 — Absolute Path Traversal — 133 CVEs
CWE-682 — Incorrect Calculation — 133 CVEs
CWE-358 — 132 CVEs
CWE-91 — XML Injection (Blind XPath Injection) — 132 CVEs
CWE-681 — Incorrect Conversion between Numeric Types — 127 CVEs
CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer — 120 CVEs
CWE-916 — Use of Password Hash With Insufficient Computational Effort — 120 CVEs
CWE-942 — Permissive Cross-domain Policy with Untrusted Domains — 118 CVEs
CWE-441 — Unintended Proxy or Intermediary (Confused Deputy) — 117 CVEs
CWE-706 — Use of Incorrectly-Resolved Name or Reference — 117 CVEs
CWE-24 — 115 CVEs
CWE-275 — Permission Issues — 113 CVEs
CWE-834 — Excessive Iteration — 111 CVEs
CWE-1392 — 109 CVEs
CWE-113 — HTTP Response Splitting — 108 CVEs
CWE-680 — Integer Overflow to Buffer Overflow — 107 CVEs
CWE-130 — Improper Handling of Length Parameter Inconsistency — 106 CVEs
CWE-117 — Improper Output Neutralization for Logs — 105 CVEs
CWE-1220 — 104 CVEs
CWE-823 — 102 CVEs
CWE-909 — 102 CVEs
CWE-669 — Incorrect Resource Transfer Between Spheres — 101 CVEs
CWE-303 — Incorrect Implementation of Authentication Algorithm — 100 CVEs
CWE-377 — Insecure Temporary File — 100 CVEs
CWE-763 — Release of Invalid Pointer or Reference — 98 CVEs
CWE-506 — 96 CVEs
CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory — 95 CVEs
CWE-178 — Improper Handling of Case Sensitivity — 93 CVEs
CWE-913 — Improper Control of Dynamically-Managed Code Resources — 93 CVEs
CWE-320 — 92 CVEs
CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification) — 92 CVEs
CWE-807 — 92 CVEs
CWE-840 — 92 CVEs
CWE-1286 — 91 CVEs
CWE-620 — 91 CVEs
CWE-328 — Use of Weak Hash — 90 CVEs
CWE-926 — 90 CVEs
CWE-598 — 89 CVEs
CWE-1390 — Weak Authentication — 88 CVEs
CWE-489 — Active Debug Code — 88 CVEs
CWE-776 — Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion) — 88 CVEs
CWE-825 — 87 CVEs
CWE-912 — Hidden Functionality — 87 CVEs
CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection) — 84 CVEs
CWE-672 — Operation on a Resource after Expiration or Release — 84 CVEs
CWE-591 — 77 CVEs
CWE-90 — LDAP Injection — 76 CVEs
CWE-15 — 75 CVEs
CWE-565 — Reliance on Cookies without Validation and Integrity Checking — 75 CVEs
CWE-150 — 74 CVEs
CWE-799 — 74 CVEs
CWE-653 — 72 CVEs
CWE-277 — Insecure Inherited Permissions — 71 CVEs
CWE-943 — Improper Neutralization of Special Elements in Data Query Logic — 71 CVEs
CWE-923 — 68 CVEs
CWE-297 — Improper Validation of Certificate with Host Mismatch — 67 CVEs
CWE-648 — 67 CVEs
CWE-257 — Storing Passwords in a Recoverable Format — 65 CVEs
CWE-267 — Privilege Defined With Unsafe Actions — 65 CVEs
CWE-348 — 65 CVEs
CWE-614 — Sensitive Cookie in HTTPS Session Without 'Secure' Attribute — 65 CVEs
CWE-29 — 63 CVEs
CWE-524 — Use of Cache Containing Sensitive Information — 63 CVEs
CWE-644 — Improper Neutralization of HTTP Headers for Scripting Syntax — 63 CVEs
CWE-197 — 62 CVEs
CWE-379 — Creation of Temporary File in Directory with Insecure Permissions — 60 CVEs
CWE-662 — Improper Synchronization — 60 CVEs
CWE-1285 — 59 CVEs
CWE-325 — Missing Cryptographic Step — 59 CVEs
CWE-841 — Improper Enforcement of Behavioral Workflow — 59 CVEs
CWE-99 — Resource Injection — 58 CVEs
CWE-548 — 57 CVEs
CWE-123 — Write-what-where Condition — 56 CVEs
CWE-805 — Buffer Access with Incorrect Length Value — 56 CVEs
CWE-940 — Improper Verification of Source of a Communication Channel — 56 CVEs
CWE-1391 — 55 CVEs
CWE-300 — Channel Accessible by Non-Endpoint — 55 CVEs
CWE-87 — Improper Neutralization of Alternate XSS Syntax — 55 CVEs
CWE-170 — Improper Null Termination — 52 CVEs
CWE-340 — 50 CVEs
CWE-405 — Asymmetric Resource Consumption (Amplification) — 47 CVEs
CWE-664 — 47 CVEs
CWE-378 — Creation of Temporary File With Insecure Permissions — 46 CVEs
CWE-183 — 45 CVEs
CWE-636 — 45 CVEs
CWE-353 — 44 CVEs
CWE-1393 — 43 CVEs
CWE-323 — Reusing a Nonce, Key Pair in Encryption — 43 CVEs
CWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) — 43 CVEs
CWE-388 — 43 CVEs
CWE-440 — Expected Behavior Violation — 43 CVEs
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag — 42 CVEs
CWE-261 — Weak Encoding for Password — 42 CVEs
CWE-274 — Improper Handling of Insufficient Privileges — 42 CVEs
CWE-302 — Authentication Bypass by Assumed-Immutable Data — 42 CVEs
CWE-185 — Incorrect Regular Expression — 41 CVEs
CWE-385 — 41 CVEs
CWE-124 — Buffer Underwrite — 40 CVEs
CWE-606 — 40 CVEs
CWE-696 — 40 CVEs
CWE-782 — 40 CVEs
CWE-273 — Improper Check for Dropped Privileges — 39 CVEs
CWE-349 — 39 CVEs
CWE-289 — 38 CVEs
CWE-791 — 38 CVEs
CWE-202 — 37 CVEs
CWE-304 — Missing Critical Step in Authentication — 37 CVEs
CWE-420 — Unprotected Alternate Channel — 37 CVEs
CWE-471 — Modification of Assumed-Immutable Data (MAID) — 37 CVEs
CWE-316 — 36 CVEs
CWE-75 — 36 CVEs
CWE-924 — Improper Enforcement of Message Integrity During Transmission in a Communication Channel — 36 CVEs
CWE-1300 — 35 CVEs
CWE-272 — 35 CVEs
CWE-424 — 35 CVEs
CWE-1289 — 34 CVEs
CWE-1385 — 34 CVEs
CWE-226 — Sensitive Information in Resource Not Removed Before Reuse — 34 CVEs
CWE-488 — 34 CVEs
CWE-92 — 34 CVEs
CWE-1395 — 33 CVEs
CWE-241 — 33 CVEs
CWE-690 — 33 CVEs
CWE-691 — 33 CVEs
CWE-213 — 32 CVEs
CWE-286 — 32 CVEs
CWE-356 — 32 CVEs
CWE-501 — Trust Boundary Violation — 32 CVEs
CWE-757 — 32 CVEs
CWE-115 — 31 CVEs
CWE-1288 — 31 CVEs
CWE-233 — 31 CVEs
CWE-313 — Cleartext Storage in a File or on Disk — 31 CVEs
CWE-525 — 31 CVEs
CWE-540 — 31 CVEs
CWE-176 — 30 CVEs
CWE-282 — 29 CVEs
CWE-41 — 29 CVEs
CWE-158 — 28 CVEs
CWE-27 — 28 CVEs
CWE-684 — 27 CVEs
CWE-758 — 27 CVEs
CWE-83 — Improper Neutralization of Script in Attributes in a Web Page — 27 CVEs
CWE-939 — 27 CVEs
CWE-114 — Process Control — 26 CVEs
CWE-1230 — 26 CVEs
CWE-1275 — 26 CVEs
CWE-270 — Privilege Context Switching Error — 26 CVEs
CWE-279 — Incorrect Execution-Assigned Permissions — 26 CVEs
CWE-322 — Key Exchange without Entity Authentication — 26 CVEs
CWE-350 — 26 CVEs
CWE-778 — 26 CVEs
CWE-1104 — 25 CVEs
CWE-118 — Incorrect Access of Indexable Resource ('Range Error') — 25 CVEs
CWE-180 — 25 CVEs
CWE-214 — 25 CVEs
CWE-523 — Unprotected Transport of Credentials — 25 CVEs
CWE-833 — 25 CVEs
CWE-253 — 24 CVEs
CWE-260 — 24 CVEs
CWE-283 — 24 CVEs
CWE-391 — 24 CVEs
CWE-592 — 24 CVEs
CWE-402 — 23 CVEs
CWE-460 — 23 CVEs
CWE-551 — 23 CVEs
CWE-96 — Improper Neutralization of Directives in Statically Saved Code (Static Code Injection) — 23 CVEs
CWE-1191 — 22 CVEs
CWE-1295 — 22 CVEs
CWE-1325 — 22 CVEs
CWE-1327 — 22 CVEs
CWE-195 — 22 CVEs
CWE-268 — Privilege Chaining — 22 CVEs
CWE-324 — Use of a Key Past its Expiration Date — 22 CVEs
CWE-603 — 22 CVEs
CWE-244 — 21 CVEs
CWE-410 — 21 CVEs
CWE-708 — 21 CVEs
CWE-1240 — 20 CVEs
CWE-140 — 20 CVEs
CWE-228 — 20 CVEs
CWE-357 — 20 CVEs
CWE-364 — Signal Handler Race Condition — 20 CVEs
CWE-590 — 20 CVEs
CWE-779 — 20 CVEs
CWE-783 — 20 CVEs
CWE-84 — 20 CVEs
CWE-229 — 19 CVEs
CWE-390 — 19 CVEs
CWE-406 — 19 CVEs
CWE-453 — 19 CVEs
CWE-526 — 19 CVEs
CWE-657 — 19 CVEs
CWE-759 — 19 CVEs
CWE-215 — Insertion of Sensitive Information Into Debugging Code — 18 CVEs
CWE-366 — Race Condition within a Thread — 18 CVEs
CWE-804 — 18 CVEs
CWE-927 — 18 CVEs
CWE-1259 — 17 CVEs
CWE-1260 — 17 CVEs
CWE-1394 — 17 CVEs
CWE-172 — 17 CVEs
CWE-26 — 17 CVEs
CWE-296 — Improper Following of a Certificate's Chain of Trust — 17 CVEs
CWE-395 — 17 CVEs
CWE-641 — Improper Restriction of Names for Files and Other Resources — 17 CVEs
CWE-698 — 17 CVEs
CWE-911 — 17 CVEs
CWE-155 — 16 CVEs
CWE-475 — 16 CVEs
CWE-477 — 16 CVEs
CWE-549 — 16 CVEs
CWE-642 — 16 CVEs
CWE-836 — 16 CVEs
CWE-837 — 16 CVEs
CWE-1050 — 15 CVEs
CWE-1386 — 15 CVEs
CWE-341 — 15 CVEs
CWE-351 — 15 CVEs
CWE-413 — 15 CVEs
CWE-417 — 15 CVEs
CWE-790 — 15 CVEs
CWE-820 — 15 CVEs
CWE-1242 — 14 CVEs
CWE-1263 — 14 CVEs
CWE-308 — Use of Single-factor Authentication — 14 CVEs
CWE-329 — Generation of Predictable IV with CBC Mode — 14 CVEs
CWE-334 — 14 CVEs
CWE-394 — 14 CVEs
CWE-449 — 14 CVEs
CWE-599 — 14 CVEs
CWE-643 — Improper Neutralization of Data within XPath Expressions (XPath Injection) — 14 CVEs
CWE-1022 — Use of Web Link to Untrusted Target with window.opener Access — 13 CVEs
CWE-1023 — 13 CVEs
CWE-1244 — 13 CVEs
CWE-1258 — 13 CVEs
CWE-138 — 13 CVEs
CWE-159 — 13 CVEs
CWE-337 — 13 CVEs
CWE-474 — 13 CVEs
CWE-625 — 13 CVEs
CWE-76 — 13 CVEs
CWE-762 — 13 CVEs
CWE-821 — 13 CVEs
CWE-838 — 13 CVEs
CWE-1025 — 12 CVEs
CWE-177 — 12 CVEs
CWE-187 — Partial String Comparison — 12 CVEs
CWE-230 — 12 CVEs
CWE-25 — 12 CVEs
CWE-265 — 12 CVEs
CWE-271 — Privilege Dropping / Lowering Errors — 12 CVEs
CWE-392 — 12 CVEs
CWE-419 — Unprotected Primary Channel — 12 CVEs
CWE-530 — 12 CVEs
CWE-701 — 12 CVEs
CWE-830 — 12 CVEs
CWE-1262 — 11 CVEs
CWE-141 — 11 CVEs
CWE-232 — 11 CVEs
CWE-242 — 11 CVEs
CWE-299 — Improper Check for Certificate Revocation — 11 CVEs
CWE-31 — 11 CVEs
CWE-547 — Use of Hard-coded, Security-relevant Constants — 11 CVEs
CWE-612 — 11 CVEs
CWE-647 — 11 CVEs
CWE-650 — Trusting HTTP Permission Methods on the Server Side — 11 CVEs
CWE-656 — 11 CVEs
CWE-694 — Use of Multiple Resources with Duplicate Identifier — 11 CVEs
CWE-86 — 11 CVEs
CWE-941 — 11 CVEs
CWE-1241 — 10 CVEs
CWE-1270 — 10 CVEs
CWE-1299 — 10 CVEs
CWE-14 — 10 CVEs
CWE-146 — 10 CVEs
CWE-258 — 10 CVEs
CWE-291 — Reliance on IP Address for Authentication — 10 CVEs
CWE-332 — 10 CVEs
CWE-363 — Race Condition Enabling Link Following — 10 CVEs
CWE-393 — 10 CVEs
CWE-564 — 10 CVEs
CWE-616 — 10 CVEs
CWE-646 — 10 CVEs
CWE-676 — 10 CVEs
CWE-692 — 10 CVEs
CWE-760 — 10 CVEs
CWE-826 — 10 CVEs
CWE-842 — 10 CVEs
CWE-1173 — 9 CVEs
CWE-1274 — 9 CVEs
CWE-1326 — 9 CVEs
CWE-223 — 9 CVEs
CWE-372 — 9 CVEs
CWE-561 — 9 CVEs
CWE-64 — 9 CVEs
CWE-705 — 9 CVEs
CWE-733 — 9 CVEs
CWE-786 — 9 CVEs
CWE-81 — 9 CVEs
CWE-921 — 9 CVEs
CWE-112 — 8 CVEs
CWE-127 — Buffer Under-read — 8 CVEs
CWE-1282 — 8 CVEs
CWE-1341 — 8 CVEs
CWE-199 — 8 CVEs
CWE-315 — 8 CVEs
CWE-317 — 8 CVEs
CWE-371 — 8 CVEs
CWE-421 — 8 CVEs