CWE Weaknesses - Common Vulnerability Types

CWE ID	Weakness Name	CVEs
CWE-79	Cross-site Scripting (XSS)	37571
CWE-89	SQL Injection	12773
CWE-20	Improper Input Validation	9123
CWE-119	Buffer Overflow	9088
CWE-787	Out-of-bounds Write	8895
CWE-862	Missing Authorization	8238
CWE-200	Information Exposure	8112
CWE-352	Cross-Site Request Forgery (CSRF)	7898
CWE-125	Out-of-bounds Read	7538
CWE-22	Path Traversal	7122
CWE-416	Use After Free	6779
CWE-284	Improper Access Control	6173
CWE-78	OS Command Injection	4985
CWE-476	NULL Pointer Dereference	4318
CWE-74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	4031
CWE-94	Code Injection	3462
CWE-264	Permissions, Privileges, and Access Controls	3317
CWE-434	Unrestricted Upload of File with Dangerous Type	3221
CWE-287	Improper Authentication	3071
CWE-918	Server-Side Request Forgery (SSRF)	2938
CWE-120	Classic Buffer Overflow	2844
CWE-863	Incorrect Authorization	2809
CWE-400	Uncontrolled Resource Consumption	2799
CWE-77	Command Injection	2628
CWE-122	Heap-based Buffer Overflow	2616
CWE-190	Integer Overflow or Wraparound	2612
CWE-502	Deserialization of Untrusted Data	2575
CWE-121	Stack-based Buffer Overflow	2460
CWE-269	Improper Privilege Management	2452
CWE-306	Missing Authentication for Critical Function	2289
CWE-639	Authorization Bypass Through User-Controlled Key	2122
CWE-310	Cryptographic Issues	1973
CWE-362	Race Condition	1925
CWE-770	Allocation of Resources Without Limits or Throttling	1660
CWE-401	Memory Leak	1486
CWE-399	Resource Management Errors	1380
CWE-601	URL Redirection to Untrusted Site (Open Redirect)	1352
CWE-798	Use of Hard-coded Credentials	1218
CWE-98	PHP Remote File Inclusion	1194
CWE-295	Improper Certificate Validation	1194
CWE-732	Incorrect Permission Assignment for Critical Resource	1181
CWE-276	Incorrect Default Permissions	1106
CWE-285	Improper Authorization	1083
CWE-59	Improper Link Resolution Before File Access	1027
CWE-611	Improper Restriction of XML External Entity Reference	1027
CWE-532	Insertion of Sensitive Information into Log File	923
CWE-427	Uncontrolled Search Path Element	922
CWE-522	Insufficiently Protected Credentials	916
CWE-266	Incorrect Privilege Assignment	880
CWE-843	Access of Resource Using Incompatible Type (Type Confusion)	712
CWE-835	Loop with Unreachable Exit Condition (Infinite Loop)	712
CWE-415	Double Free	681
CWE-319	Cleartext Transmission of Sensitive Information	674
CWE-347	Improper Verification of Cryptographic Signature	643
CWE-908	Use of Uninitialized Resource	642
CWE-693	Protection Mechanism Failure	632
CWE-404	Improper Resource Shutdown or Release	620
CWE-367	Time-of-check Time-of-use (TOCTOU) Race Condition	610
CWE-617	Reachable Assertion	596
CWE-288	Authentication Bypass Using an Alternate Path or Channel	592
CWE-312	Cleartext Storage of Sensitive Information	577
CWE-346	Origin Validation Error	571
CWE-426	Untrusted Search Path	569
CWE-290	Authentication Bypass by Spoofing	560
CWE-667	Improper Locking	545
CWE-345	Insufficient Verification of Data Authenticity	543
CWE-307	Improper Restriction of Excessive Authentication Attempts	522
CWE-203	Observable Discrepancy	518
CWE-189	Numeric Errors	512
CWE-73	External Control of File Name or Path	488
CWE-209	Error Message Information Leak	481
CWE-613	Insufficient Session Expiration	477
CWE-327	Use of a Broken or Risky Cryptographic Algorithm	477
CWE-754	Improper Check for Unusual or Exceptional Conditions	470
CWE-1321	Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)	459
CWE-126	Buffer Over-read	413
CWE-129	Improper Validation of Array Index	412
CWE-674	Uncontrolled Recursion	408
CWE-255	Credentials Management Errors	407
CWE-23	Relative Path Traversal	402
CWE-191	Integer Underflow	401
CWE-369	Divide By Zero	390
CWE-428	Unquoted Search Path or Element	377
CWE-772	Missing Release of Resource after Effective Lifetime	369
CWE-201	Insertion of Sensitive Information Into Sent Data	360
CWE-668	Exposure of Resource to Wrong Sphere	359
CWE-80	Basic XSS	355
CWE-451	User Interface (UI) Misrepresentation of Critical Information	349
CWE-755	Improper Handling of Exceptional Conditions	337
CWE-552	Files or Directories Accessible to External Parties	337
CWE-254	7PK - Security Features	330
CWE-497	Exposure of Sensitive System Information to an Unauthorized Control Sphere	329
CWE-88	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')	324
CWE-1021	Improper Restriction of Rendered UI Layers or Frames	324
CWE-444	HTTP Request/Response Smuggling	319
CWE-384	Session Fixation	316
CWE-1333	Inefficient Regular Expression Complexity (ReDoS)	308
CWE-326	Inadequate Encryption Strength	295
CWE-250	Execution with Unnecessary Privileges	288
CWE-281	Improper Preservation of Permissions	272
CWE-321	Use of Hard-coded Cryptographic Key	271
CWE-116	Improper Encoding or Escaping of Output	269
CWE-1284	Improper Validation of Specified Quantity in Input	254
CWE-1236	Improper Neutralization of Formula Elements in a CSV File	253
CWE-330	Use of Insufficiently Random Values	250
CWE-665	Improper Initialization	239
CWE-922	Insecure Storage of Sensitive Information	238
CWE-311	Missing Encryption of Sensitive Data	236
CWE-640	Weak Password Recovery Mechanism for Forgotten Password	229
CWE-248	Uncaught Exception	228
CWE-294	Authentication Bypass by Capture-replay	224
CWE-824	Access of Uninitialized Pointer	219
CWE-134	Use of Externally-Controlled Format String	218
CWE-1188	Initialization of a Resource with an Insecure Default	211
CWE-19	Data Processing Errors	209
CWE-521	Weak Password Requirements	197
CWE-457	Use of Uninitialized Variable	193
CWE-829	Inclusion of Functionality from Untrusted Control Sphere	193
CWE-822	Untrusted Pointer Dereference	190
CWE-93	Improper Neutralization of CRLF Sequences ('CRLF Injection')	188
CWE-256	Plaintext Storage of a Password	185
CWE-789	Memory Allocation with Excessive Size Value	173
CWE-707	Improper Neutralization	172
CWE-494	Download of Code Without Integrity Check	169
CWE-917	Improper Neutralization of Special Elements used in an Expression Language Statement	169
CWE-359	Exposure of Private Personal Information to an Unauthorized Actor	165
CWE-35	Path Traversal: '.../...//'	162
CWE-1336	Improper Neutralization of Special Elements Used in a Template Engine	160
CWE-259	Use of Hard-coded Password	158
CWE-17	DEPRECATED: Code	158
CWE-425	Direct Request ('Forced Browsing')	156
CWE-459	Incomplete Cleanup	153
CWE-208	Observable Timing Discrepancy	151
CWE-204	Observable Response Discrepancy	148
CWE-704	Incorrect Type Conversion or Cast	148
CWE-193	Off-by-one Error	147
CWE-184	Incomplete List of Disallowed Inputs	147
CWE-338	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	142
CWE-280	Improper Handling of Insufficient Permissions or Privileges	141
CWE-602	Client-Side Enforcement of Server-Side Security	140
CWE-95	Eval Injection	140
CWE-610	Externally Controlled Reference to a Resource in Another Sphere	139
CWE-354	Improper Validation of Integrity Check Value	138
CWE-472	External Control of Assumed-Immutable Web Parameter	137
CWE-131	Incorrect Calculation of Buffer Size	129
CWE-305	Authentication Bypass by Primary Weakness	128
CWE-407	Inefficient Algorithmic Complexity	126
CWE-670	Always-Incorrect Control Flow Implementation	122
CWE-36	Absolute Path Traversal	122
CWE-703	Improper Check or Handling of Exceptional Conditions	119
CWE-61	UNIX Symbolic Link (Symlink) Following	117
CWE-749	Exposed Dangerous Method or Function	113
CWE-1287	Improper Validation of Specified Type of Input	113
CWE-252	Unchecked Return Value	112
CWE-788	Access of Memory Location After End of Buffer	111
CWE-91	XML Injection (aka Blind XPath Injection)	110
CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	106
CWE-441	Unintended Proxy or Intermediary ('Confused Deputy')	106
CWE-331	Insufficient Entropy	100
CWE-682	Incorrect Calculation	99
CWE-409	Improper Handling of Highly Compressed Data (Data Amplification)	99
CWE-706	Use of Incorrectly-Resolved Name or Reference	95
CWE-117	Improper Output Neutralization for Logs	93
CWE-697	Incorrect Comparison	92
CWE-1392	Use of Default Credentials	91
CWE-943	Improper Neutralization of Special Elements in Data Query Logic	91
CWE-16	Configuration	87
CWE-680	Integer Overflow to Buffer Overflow	87
CWE-1220	Insufficient Granularity of Access Control	86
CWE-840	Business Logic Errors	85
CWE-358	Improperly Implemented Security Check for Standard	85
CWE-436	Interpretation Conflict	85
CWE-834	Excessive Iteration	84
CWE-926	Improper Export of Android Application Components	83
CWE-130	Improper Handling of Length Parameter Inconsistency	82
CWE-1390	Weak Authentication	82
CWE-620	Unverified Password Change	82
CWE-942	Permissive Cross-domain Security Policy with Untrusted Domains	82
CWE-113	HTTP Response Splitting	81
CWE-24	Path Traversal: '../filedir'	81
CWE-598	Use of GET Request Method With Sensitive Query Strings	76
CWE-669	Incorrect Resource Transfer Between Spheres	76
CWE-823	Use of Out-of-range Pointer Offset	76
CWE-303	Incorrect Implementation of Authentication Algorithm	76
CWE-178	Improper Handling of Case Sensitivity	76
CWE-90	LDAP Injection	75
CWE-470	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	73
CWE-538	Insertion of Sensitive Information into Externally-Accessible File	73
CWE-916	Use of Password Hash With Insufficient Computational Effort	72
CWE-377	Insecure Temporary File	72
CWE-275	Permission Issues	72
CWE-681	Incorrect Conversion between Numeric Types	72
CWE-15	External Control of System or Configuration Setting	70
CWE-212	Improper Removal of Sensitive Information Before Storage or Transfer	70
CWE-489	Active Debug Code	68
CWE-763	Release of Invalid Pointer or Reference	67
CWE-328	Use of Weak Hash	67
CWE-1286	Improper Validation of Syntactic Correctness of Input	66
CWE-807	Reliance on Untrusted Inputs in a Security Decision	65
CWE-591	Sensitive Data Storage in Improperly Locked Memory	65
CWE-913	Improper Control of Dynamically-Managed Code Resources	64
CWE-29	Path Traversal: '\\..\\filename'	61
CWE-912	Hidden Functionality	60
CWE-297	Improper Validation of Certificate with Host Mismatch	59
CWE-909	Missing Initialization of Resource	59
CWE-277	Insecure Inherited Permissions	58
CWE-923	Improper Restriction of Communication Channel to Intended Endpoints	58
CWE-99	Improper Control of Resource Identifiers ('Resource Injection')	57
CWE-653	Improper Isolation or Compartmentalization	56
CWE-197	Numeric Truncation Error	56
CWE-320	Key Management Errors	55
CWE-257	Storing Passwords in a Recoverable Format	55
CWE-150	Improper Neutralization of Escape, Meta, or Control Sequences	55
CWE-648	Incorrect Use of Privileged APIs	54
CWE-776	Improper Restriction of Recursive Entity References in DTDs	54
CWE-348	Use of Less Trusted Source	52
CWE-524	Use of Cache Containing Sensitive Information	52
CWE-841	Improper Enforcement of Behavioral Workflow	51
CWE-614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	50
CWE-644	Improper Neutralization of HTTP Headers for Scripting Syntax	50
CWE-672	Operation on a Resource after Expiration or Release	48
CWE-506	Embedded Malicious Code	47
CWE-565	Reliance on Cookies without Validation and Integrity Checking	47
CWE-123	Write-what-where Condition	46
CWE-825	Expired Pointer Dereference	46
CWE-379	Creation of Temporary File in Directory with Insecure Permissions	45
CWE-325	Missing Cryptographic Step	44
CWE-940	Improper Verification of Source of a Communication Channel	44
CWE-799	Improper Control of Interaction Frequency	44
CWE-1391	Use of Weak Credentials	44
CWE-267	Privilege Defined With Unsafe Actions	43
CWE-664	Improper Control of a Resource Through its Lifetime	43
CWE-300	Channel Accessible by Non-Endpoint	43
CWE-1285	Improper Validation of Specified Index, Position, or Offset in Input	41
CWE-548	Exposure of Information Through Directory Listing	41
CWE-782	Exposed IOCTL with Insufficient Access Control	41
CWE-323	Reusing a Nonce, Key Pair in Encryption	41
CWE-440	Expected Behavior Violation	40
CWE-378	Creation of Temporary File With Insecure Permissions	40
CWE-405	Asymmetric Resource Consumption (Amplification)	39
CWE-805	Buffer Access with Incorrect Length Value	38
CWE-170	Improper Null Termination	38
CWE-636	Not Failing Securely ('Failing Open')	36
CWE-1300	Improper Protection of Physical Side Channels	35
CWE-696	Incorrect Behavior Order	35
CWE-261	Weak Encoding for Password	35
CWE-302	Authentication Bypass by Assumed-Immutable Data	35
CWE-183	Permissive List of Allowed Inputs	35
CWE-353	Missing Support for Integrity Check	34
CWE-471	Modification of Assumed-Immutable Data (MAID)	34
CWE-1393	Use of Default Password	34
CWE-316	Cleartext Storage of Sensitive Information in Memory	34
CWE-488	Exposure of Data Element to Wrong Session	33
CWE-124	Buffer Underwrite ('Buffer Underflow')	33
CWE-424	Improper Protection of Alternate Path	33
CWE-226	Sensitive Information in Resource Not Removed Before Reuse	32
CWE-87	Improper Neutralization of Alternate XSS Syntax	32
CWE-274	Improper Handling of Insufficient Privileges	32
CWE-340	Generation of Predictable Numbers or Identifiers	32
CWE-606	Unchecked Input for Loop Condition	31
CWE-304	Missing Critical Step in Authentication	31
CWE-185	Incorrect Regular Expression	31
CWE-420	Unprotected Alternate Channel	30
CWE-289	Authentication Bypass by Alternate Name	30
CWE-349	Acceptance of Extraneous Untrusted Data With Trusted Data	30
CWE-202	Exposure of Sensitive Information Through Data Queries	29
CWE-388	7PK - Errors	29
CWE-283	Unverified Ownership	28
CWE-272	Least Privilege Violation	28
CWE-273	Improper Check for Dropped Privileges	28
CWE-1385	Missing Origin Validation in WebSockets	28
CWE-691	Insufficient Control Flow Management	28
CWE-213	Exposure of Sensitive Information Due to Incompatible Policies	27
CWE-41	Improper Resolution of Path Equivalence	27
CWE-241	Improper Handling of Unexpected Data Type	27
CWE-335	Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)	27
CWE-282	Improper Ownership Management	27
CWE-540	Inclusion of Sensitive Information in Source Code	27
CWE-1230	Exposure of Sensitive Information Through Metadata	26
CWE-778	Insufficient Logging	26
CWE-286	Incorrect User Management	26
CWE-791	Incomplete Filtering of Special Elements	26
CWE-924	Improper Enforcement of Message Integrity During Transmission	25
CWE-1004	Sensitive Cookie Without 'HttpOnly' Flag	25
CWE-939	Improper Authorization in Handler for Custom URL Scheme	24
CWE-525	Use of Web Browser Cache Containing Sensitive Information	24
CWE-176	Improper Handling of Unicode Encoding	24
CWE-75	Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)	24
CWE-1289	Improper Validation of Unsafe Equivalence in Input	23
CWE-1288	Improper Validation of Consistency within Input	23
CWE-158	Improper Neutralization of Null Byte or NUL Character	23
CWE-233	Improper Handling of Parameters	23
CWE-684	Incorrect Provision of Specified Functionality	23
CWE-115	Misinterpretation of Input	23
CWE-350	Reliance on Reverse DNS Resolution for a Security-Critical Action	22
CWE-180	Incorrect Behavior Order: Validate Before Canonicalize	22
CWE-757	Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	22
CWE-385	Covert Timing Channel	22
CWE-96	Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')	22
CWE-402	Transmission of Private Resources into a New Sphere ('Resource Leak')	21
CWE-313	Cleartext Storage in a File or on Disk	21
CWE-1104	Use of Unmaintained Third Party Components	21
CWE-662	Improper Synchronization	21
CWE-1327	Binding to an Unrestricted IP Address	21
CWE-603	Use of Client-Side Authentication	21
CWE-214	Invocation of Process Using Visible Sensitive Information	21
CWE-526	Cleartext Storage of Sensitive Information in an Environment Variable	20
CWE-270	Privilege Context Switching Error	20
CWE-114	Process Control	20
CWE-253	Incorrect Check of Function Return Value	20
CWE-501	Trust Boundary Violation	20
CWE-215	Insertion of Sensitive Information Into Debugging Code	19
CWE-260	Password in Configuration File	19
CWE-268	Privilege Chaining	19
CWE-279	Incorrect Execution-Assigned Permissions	19
CWE-83	Improper Neutralization of Script in Attributes in a Web Page	19
CWE-324	Use of a Key Past its Expiration Date	19
CWE-523	Unprotected Transport of Credentials	19
CWE-410	Insufficient Resource Pool	18
CWE-27	Path Traversal: 'dir/../../filename'	18
CWE-590	Free of Memory not on the Heap	18
CWE-356	Product UI does not Warn User of Unsafe Actions	18
CWE-357	Insufficient UI Warning of Dangerous Operations	18
CWE-84	Improper Neutralization of Encoded URI Schemes in a Web Page	18
CWE-244	Improper Clearing of Heap Memory Before Release ('Heap Inspection')	18
CWE-460	Improper Cleanup on Thrown Exception	18
CWE-390	Detection of Error Condition Without Action	18
CWE-698	Execution After Redirect (EAR)	17
CWE-1325	Improperly Controlled Sequential Memory Allocation	17
CWE-690	Unchecked Return Value to NULL Pointer Dereference	17
CWE-783	Operator Precedence Logic Error	17
CWE-140	Improper Neutralization of Delimiters	17
CWE-1295	Debug Messages Revealing Unnecessary Information	17
CWE-1394	Use of Default Cryptographic Key	17
CWE-228	Improper Handling of Syntactically Invalid Structure	17
CWE-229	Improper Handling of Values	17
CWE-1191	On-Chip Debug and Test Interface With Improper Access Control	17
CWE-833	Deadlock	16
CWE-118	Incorrect Access of Indexable Resource ('Range Error')	16
CWE-1260	Improper Handling of Overlap Between Protected Memory Ranges	16
CWE-477	Use of Obsolete Function	16
CWE-708	Incorrect Ownership Assignment	16
CWE-779	Logging of Excessive Data	16
CWE-1240	Use of a Cryptographic Primitive with a Risky Implementation	15
CWE-366	Race Condition within a Thread	15
CWE-172	Encoding Error	15
CWE-195	Signed to Unsigned Conversion Error	15
CWE-758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior	15
CWE-322	Key Exchange without Entity Authentication	15
CWE-911	Improper Update of Reference Count	14
CWE-759	Use of a One-Way Hash without a Salt	14
CWE-155	Improper Neutralization of Wildcards or Matching Symbols	14
CWE-1395	Dependency on Vulnerable Third-Party Component	14
CWE-820	Missing Synchronization	14
CWE-790	Improper Filtering of Special Elements	14
CWE-657	Violation of Secure Design Principles	14
CWE-76	Improper Neutralization of Equivalent Special Elements	14
CWE-449	The UI Performs the Wrong Action	14
CWE-821	Incorrect Synchronization	13
CWE-549	Missing Password Field Masking	13
CWE-177	Improper Handling of URL Encoding (Hex Encoding)	13
CWE-1259	Improper Restriction of Security Token Assignment	13
CWE-308	Use of Single-factor Authentication	13
CWE-1258	Exposure of Sensitive System Information Due to Uncleared Debug Information	13
CWE-838	Inappropriate Encoding for Output Context	13
CWE-837	Improper Enforcement of a Single, Unique Action	13
CWE-641	Improper Restriction of Names for Files and Other Resources	12
CWE-92	DEPRECATED: Improper Sanitization of Custom Special Characters	12
CWE-364	Signal Handler Race Condition	12
CWE-592	DEPRECATED: Authentication Bypass Issues	12
CWE-1386	Insecure Operation on Windows Junction / Mount Point	12
CWE-341	Predictable from Observable State	12
CWE-26	Path Traversal: '/dir/../filename'	12
CWE-643	Improper Neutralization of Data within XPath Expressions ('XPath Injection')	12
CWE-230	Improper Handling of Missing Values	12
CWE-836	Use of Password Hash Instead of Password for Authentication	11
CWE-1050	Excessive Platform Resource Consumption within a Loop	11
CWE-453	Insecure Default Variable Initialization	11
CWE-927	Use of Implicit Intent for Sensitive Communication	11
CWE-296	Improper Following of a Certificate's Chain of Trust	11
CWE-299	Improper Check for Certificate Revocation	11
CWE-804	Guessable CAPTCHA	11
CWE-1242	Inclusion of Undocumented Features or Chicken Bits	11
CWE-1025	Comparison Using Wrong Factors	11
CWE-413	Improper Resource Locking	11
CWE-475	Undefined Behavior for Input to API	11
CWE-1023	Incomplete Comparison with Missing Factors	10
CWE-14	Compiler Removal of Code to Clear Buffers	10
CWE-625	Permissive Regular Expression	10
CWE-291	Reliance on IP Address for Authentication	10
CWE-647	Use of Non-Canonical URL Paths for Authorization Decisions	10
CWE-232	Improper Handling of Undefined Values	10
CWE-351	Insufficient Type Distinction	10
CWE-265	Privilege Issues	10
CWE-1244	Internal Asset Exposed to Unsafe Debug Access Level or State	10
CWE-656	Reliance on Security Through Obscurity	10
CWE-223	Omission of Security-relevant Information	10
CWE-612	Improper Authorization of Index Containing Sensitive Information	10
CWE-138	Improper Neutralization of Special Elements	10
CWE-146	Improper Neutralization of Expression/Command Delimiters	10
CWE-159	Improper Handling of Invalid Use of Special Elements	10
CWE-394	Unexpected Status Code or Return Value	10
CWE-395	Use of NullPointerException Catch to Detect NULL Pointer Dereference	10
CWE-187	Partial String Comparison	10
CWE-417	Communication Channel Errors	10
CWE-830	Inclusion of Web Functionality from an Untrusted Source	10
CWE-530	Exposure of Backup File to an Unauthorized Control Sphere	9
CWE-650	Trusting HTTP Permission Methods on the Server Side	9
CWE-474	Use of Function with Inconsistent Implementations	9
CWE-334	Small Space of Random Values	9
CWE-391	Unchecked Error Condition	9
CWE-419	Unprotected Primary Channel	9
CWE-564	SQL Injection: Hibernate	9
CWE-258	Empty Password in Configuration File	9
CWE-599	Missing Validation of OpenSSL Certificate	9
CWE-242	Use of Inherently Dangerous Function	9
CWE-1275	Sensitive Cookie with Improper SameSite Attribute	9
CWE-141	Improper Neutralization of Parameter/Argument Delimiters	9
CWE-561	Dead Code	9
CWE-64	Windows Shortcut Following (.LNK)	9
CWE-86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages	9
CWE-760	Use of a One-Way Hash with a Predictable Salt	8
CWE-701	Weaknesses Introduced During Design	8
CWE-271	Privilege Dropping / Lowering Errors	8
CWE-371	State Issues	8
CWE-762	Mismatched Memory Management Routines	8
CWE-1022	Use of Web Link to Untrusted Target with window.opener Access	8
CWE-480	Use of Incorrect Operator	8
CWE-392	Missing Report of Error Condition	8
CWE-547	Use of Hard-coded, Security-relevant Constants	8
CWE-1299	Missing Protection Mechanism for Alternate Hardware Interface	8
CWE-332	Insufficient Entropy in PRNG	8
CWE-466	Return of Pointer Value Outside of Expected Range	8
CWE-551	Incorrect Behavior Order: Authorization Before Parsing and Canonicalization	8
CWE-676	Use of Potentially Dangerous Function	8
CWE-337	Predictable Seed in Pseudo-Random Number Generator (PRNG)	8
CWE-1262	Improper Access Control for Register Interface	7
CWE-642	External Control of Critical State Data	7
CWE-278	Insecure Preserved Inherited Permissions	7
CWE-826	Premature Release of Resource During Expected Lifetime	7
CWE-1241	Use of Predictable Algorithm in Random Number Generator	7
CWE-941	Incorrectly Specified Destination in a Communication Channel	7
CWE-1270	Generation of Incorrect Security Tokens	7
CWE-329	Generation of Predictable IV with CBC Mode	7
CWE-25	Path Traversal: '/../filedir'	7
CWE-1282	Assumed-Immutable Data is Stored in Writable Memory	7
CWE-646	Reliance on File Name or Extension of Externally-Supplied File	7
CWE-616	Incomplete Identification of Uploaded File Variables (PHP)	7
CWE-65	Windows Hard Link	7
CWE-372	Incomplete Internal State Distinction	7
CWE-199	Information Management Errors	7
CWE-1088	Synchronous Access of Remote Resource without Timeout	7
CWE-406	Insufficient Control of Network Message Volume (Network Amplification)	7
CWE-408	Incorrect Behavior Order: Early Amplification	7
CWE-694	Use of Multiple Resources with Duplicate Identifier	7
CWE-567	Unsynchronized Access to Shared Data in a Multithreaded Context	7
CWE-1427	Improper Neutralization of Input Used for LLM Prompting	7
CWE-539	Use of Persistent Cookies Containing Sensitive Information	7
CWE-566	Authorization Bypass Through User-Controlled SQL Primary Key	6
CWE-1384	Improper Handling of Physical or Environmental Conditions	6
CWE-1357	Reliance on Insufficiently Trustworthy Component	6
CWE-421	Race Condition During Access to Alternate Channel	6
CWE-562	Return of Stack Variable Address	6
CWE-173	Improper Handling of Alternate Encoding	6
CWE-921	Storage of Sensitive Data in a Mechanism without Access Control	6
CWE-1038	Insecure Automated Optimizations	6
CWE-18	DEPRECATED: Source Code	6
CWE-97	Improper Neutralization of Server-Side Includes (SSI) Within a Web Page	6
CWE-1326	Missing Immutable Root of Trust in Hardware	6
CWE-456	Missing Initialization of a Variable	6
CWE-393	Return of Wrong Status Code	6
CWE-1320	Improper Protection for Outbound Error Messages and Alert Signals	6
CWE-771	Missing Reference to Active Allocated Resource	6
CWE-37	Path Traversal: '/absolute/pathname/here'	6
CWE-842	Placement of User into Incorrect Group	6
CWE-645	Overly Restrictive Account Lockout Mechanism	6
CWE-1274	Improper Access Control for Volatile Memory Containing Boot Code	6
CWE-31	Path Traversal: 'dir\..\..\filename'	6
CWE-1263	Improper Physical Access Control	6
CWE-298	Improper Validation of Certificate Expiration	6
CWE-573	Improper Following of Specification by Caller	6
CWE-82	Improper Neutralization of Script in Attributes of IMG Tags in a Web Page	6
CWE-775	Missing Release of File Descriptor or Handle after Effective Lifetime	5
CWE-1037	Processor Optimization Removal or Modification of Security-critical Code	5
CWE-112	Missing XML Validation	5
CWE-1125	Excessive Attack Surface	5
CWE-1173	Improper Use of Validation Framework	5
CWE-1250	Improper Preservation of Consistency Between Independent Representations of Shared State	5
CWE-127	Buffer Under-read	5
CWE-1281	Sequence of Processor Instructions Leads to Unexpected Behavior	5
CWE-1329	Reliance on Component That is Not Updateable	5
CWE-153	Improper Neutralization of Substitution Characters	5
CWE-156	Improper Neutralization of Whitespace	5
CWE-167	Improper Handling of Additional Special Element	5
CWE-179	Incorrect Behavior Order: Early Validation	5
CWE-196	Unsigned to Signed Conversion Error	5
CWE-262	Not Using Password Aging	5
CWE-315	Cleartext Storage of Sensitive Information in a Cookie	5
CWE-317	Cleartext Storage of Sensitive Information in GUI	5
CWE-342	Predictable Exact Value from Previous Values	5

CWE-79

Cross-site Scripting (XSS)

37571

CWE-89

SQL Injection

12773

CWE-20

Improper Input Validation

9123

CWE-119

Buffer Overflow

9088