CWE Weaknesses - Common Vulnerability Types

CWE ID	Weakness Name	CVEs
CWE-79	Cross-site Scripting (XSS)	9101
CWE-862	Missing Authorization	2777
CWE-74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	2501
CWE-89	SQL Injection	2307
CWE-352	Cross-Site Request Forgery (CSRF)	1978
CWE-22	Path Traversal	1458
CWE-119	Buffer Overflow	1168
CWE-284	Improper Access Control	1107
CWE-416	Use After Free	1015
CWE-125	Out-of-bounds Read	1011
CWE-476	NULL Pointer Dereference	962
CWE-78	OS Command Injection	948
CWE-200	Information Exposure	947
CWE-787	Out-of-bounds Write	894
CWE-20	Improper Input Validation	885
CWE-918	Server-Side Request Forgery (SSRF)	840
CWE-98	PHP Remote File Inclusion	783
CWE-94	Code Injection	733
CWE-502	Deserialization of Untrusted Data	696
CWE-77	Command Injection	679
CWE-863	Incorrect Authorization	664
CWE-121	Stack-based Buffer Overflow	653
CWE-434	Unrestricted Upload of File with Dangerous Type	624
CWE-122	Heap-based Buffer Overflow	615
CWE-639	Authorization Bypass Through User-Controlled Key	536
CWE-120	Classic Buffer Overflow	535
CWE-400	Uncontrolled Resource Consumption	530
CWE-306	Missing Authentication for Critical Function	504
CWE-266	Incorrect Privilege Assignment	494
CWE-770	Allocation of Resources Without Limits or Throttling	478
CWE-287	Improper Authentication	434
CWE-269	Improper Privilege Management	375
CWE-362	Race Condition	339
CWE-401	Memory Leak	314
CWE-601	URL Redirection to Untrusted Site (Open Redirect)	287
CWE-190	Integer Overflow or Wraparound	285
CWE-285	Improper Authorization	243
CWE-276	Incorrect Default Permissions	233
CWE-288	Authentication Bypass Using an Alternate Path or Channel	225
CWE-427	Uncontrolled Search Path Element	217
CWE-295	Improper Certificate Validation	206
CWE-732	Incorrect Permission Assignment for Critical Resource	203
CWE-798	Use of Hard-coded Credentials	188
CWE-428	Unquoted Search Path or Element	187
CWE-404	Improper Resource Shutdown or Release	185
CWE-532	Insertion of Sensitive Information into Log File	183
CWE-497	Exposure of Sensitive System Information to an Unauthorized Control Sphere	176
CWE-201	Insertion of Sensitive Information Into Sent Data	169
CWE-59	Improper Link Resolution Before File Access	162
CWE-73	External Control of File Name or Path	159
CWE-667	Improper Locking	148
CWE-367	Time-of-check Time-of-use (TOCTOU) Race Condition	134
CWE-80	Basic XSS	132
CWE-522	Insufficiently Protected Credentials	130
CWE-290	Authentication Bypass by Spoofing	130
CWE-843	Access of Resource Using Incompatible Type (Type Confusion)	125
CWE-908	Use of Uninitialized Resource	124
CWE-307	Improper Restriction of Excessive Authentication Attempts	124
CWE-754	Improper Check for Unusual or Exceptional Conditions	122
CWE-693	Protection Mechanism Failure	121
CWE-126	Buffer Over-read	120
CWE-617	Reachable Assertion	120
CWE-347	Improper Verification of Cryptographic Signature	119
CWE-23	Relative Path Traversal	118
CWE-319	Cleartext Transmission of Sensitive Information	117
CWE-209	Error Message Information Leak	115
CWE-611	Improper Restriction of XML External Entity Reference	106
CWE-613	Insufficient Session Expiration	105
CWE-312	Cleartext Storage of Sensitive Information	103
CWE-835	Loop with Unreachable Exit Condition (Infinite Loop)	100
CWE-415	Double Free	99
CWE-346	Origin Validation Error	98
CWE-426	Untrusted Search Path	96
CWE-1321	Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)	93
CWE-327	Use of a Broken or Risky Cryptographic Algorithm	92
CWE-321	Use of Hard-coded Cryptographic Key	92
CWE-1333	Inefficient Regular Expression Complexity (ReDoS)	89
CWE-451	User Interface (UI) Misrepresentation of Critical Information	87
CWE-250	Execution with Unnecessary Privileges	87
CWE-345	Insufficient Verification of Data Authenticity	84
CWE-1284	Improper Validation of Specified Quantity in Input	80
CWE-191	Integer Underflow	77
CWE-129	Improper Validation of Array Index	76
CWE-674	Uncontrolled Recursion	75
CWE-35	Path Traversal: '.../...//'	75
CWE-248	Uncaught Exception	73
CWE-88	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')	73
CWE-203	Observable Discrepancy	66
CWE-359	Exposure of Private Personal Information to an Unauthorized Actor	64
CWE-552	Files or Directories Accessible to External Parties	64
CWE-116	Improper Encoding or Escaping of Output	63
CWE-369	Divide By Zero	61
CWE-256	Plaintext Storage of a Password	61
CWE-204	Observable Response Discrepancy	60
CWE-444	HTTP Request/Response Smuggling	60
CWE-1336	Improper Neutralization of Special Elements Used in a Template Engine	58
CWE-1287	Improper Validation of Specified Type of Input	57
CWE-822	Untrusted Pointer Dereference	57
CWE-1021	Improper Restriction of Rendered UI Layers or Frames	55
CWE-384	Session Fixation	52
CWE-36	Absolute Path Traversal	51
CWE-281	Improper Preservation of Permissions	50
CWE-1188	Initialization of a Resource with an Insecure Default	50
CWE-259	Use of Hard-coded Password	50
CWE-93	Improper Neutralization of CRLF Sequences ('CRLF Injection')	46
CWE-1392	Use of Default Credentials	45
CWE-280	Improper Handling of Insufficient Permissions or Privileges	45
CWE-61	UNIX Symbolic Link (Symlink) Following	45
CWE-922	Insecure Storage of Sensitive Information	44
CWE-472	External Control of Assumed-Immutable Web Parameter	44
CWE-829	Inclusion of Functionality from Untrusted Control Sphere	43
CWE-305	Authentication Bypass by Primary Weakness	43
CWE-640	Weak Password Recovery Mechanism for Forgotten Password	41
CWE-602	Client-Side Enforcement of Server-Side Security	41
CWE-494	Download of Code Without Integrity Check	41
CWE-1390	Weak Authentication	41
CWE-521	Weak Password Requirements	40
CWE-441	Unintended Proxy or Intermediary ('Confused Deputy')	40
CWE-457	Use of Uninitialized Variable	40
CWE-208	Observable Timing Discrepancy	39
CWE-598	Use of GET Request Method With Sensitive Query Strings	36
CWE-620	Unverified Password Change	36
CWE-789	Memory Allocation with Excessive Size Value	35
CWE-926	Improper Export of Android Application Components	35
CWE-338	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	34
CWE-95	Eval Injection	34
CWE-755	Improper Handling of Exceptional Conditions	33
CWE-264	Permissions, Privileges, and Access Controls	33
CWE-1220	Insufficient Granularity of Access Control	33
CWE-294	Authentication Bypass by Capture-replay	32
CWE-653	Improper Isolation or Compartmentalization	32
CWE-407	Inefficient Algorithmic Complexity	32
CWE-824	Access of Uninitialized Pointer	32
CWE-610	Externally Controlled Reference to a Resource in Another Sphere	31
CWE-942	Permissive Cross-domain Security Policy with Untrusted Domains	31
CWE-15	External Control of System or Configuration Setting	31
CWE-668	Exposure of Resource to Wrong Sphere	30
CWE-749	Exposed Dangerous Method or Function	30
CWE-117	Improper Output Neutralization for Logs	30
CWE-1286	Improper Validation of Syntactic Correctness of Input	29
CWE-326	Inadequate Encryption Strength	29
CWE-330	Use of Insufficiently Random Values	29
CWE-24	Path Traversal: '../filedir'	29
CWE-538	Insertion of Sensitive Information into Externally-Accessible File	28
CWE-331	Insufficient Entropy	28
CWE-311	Missing Encryption of Sensitive Data	28
CWE-459	Incomplete Cleanup	28
CWE-193	Off-by-one Error	27
CWE-703	Improper Check or Handling of Exceptional Conditions	27
CWE-807	Reliance on Untrusted Inputs in a Security Decision	27
CWE-425	Direct Request ('Forced Browsing')	26
CWE-409	Improper Handling of Highly Compressed Data (Data Amplification)	26
CWE-823	Use of Out-of-range Pointer Offset	26
CWE-184	Incomplete List of Disallowed Inputs	26
CWE-310	Cryptographic Issues	25
CWE-644	Improper Neutralization of HTTP Headers for Scripting Syntax	24
CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	24
CWE-840	Business Logic Errors	23
CWE-354	Improper Validation of Integrity Check Value	23
CWE-303	Incorrect Implementation of Authentication Algorithm	23
CWE-99	Improper Control of Resource Identifiers ('Resource Injection')	22
CWE-506	Embedded Malicious Code	22
CWE-669	Incorrect Resource Transfer Between Spheres	22
CWE-805	Buffer Access with Incorrect Length Value	22
CWE-348	Use of Less Trusted Source	22
CWE-1236	Improper Neutralization of Formula Elements in a CSV File	22
CWE-923	Improper Restriction of Communication Channel to Intended Endpoints	21
CWE-328	Use of Weak Hash	21
CWE-131	Incorrect Calculation of Buffer Size	21
CWE-134	Use of Externally-Controlled Format String	21
CWE-665	Improper Initialization	21
CWE-943	Improper Neutralization of Special Elements in Data Query Logic	21
CWE-912	Hidden Functionality	21
CWE-704	Incorrect Type Conversion or Cast	20
CWE-113	HTTP Response Splitting	20
CWE-90	LDAP Injection	20
CWE-1393	Use of Default Password	20
CWE-150	Improper Neutralization of Escape, Meta, or Control Sequences	19
CWE-277	Insecure Inherited Permissions	19
CWE-1391	Use of Weak Credentials	18
CWE-358	Improperly Implemented Security Check for Standard	18
CWE-680	Integer Overflow to Buffer Overflow	18
CWE-670	Always-Incorrect Control Flow Implementation	18
CWE-405	Asymmetric Resource Consumption (Amplification)	18
CWE-257	Storing Passwords in a Recoverable Format	18
CWE-29	Path Traversal: '\\..\\filename'	17
CWE-913	Improper Control of Dynamically-Managed Code Resources	17
CWE-267	Privilege Defined With Unsafe Actions	16
CWE-41	Improper Resolution of Path Equivalence	16
CWE-252	Unchecked Return Value	16
CWE-178	Improper Handling of Case Sensitivity	16
CWE-841	Improper Enforcement of Behavioral Workflow	16
CWE-130	Improper Handling of Length Parameter Inconsistency	16
CWE-548	Exposure of Information Through Directory Listing	16
CWE-320	Key Management Errors	16
CWE-212	Improper Removal of Sensitive Information Before Storage or Transfer	16
CWE-772	Missing Release of Resource after Effective Lifetime	16
CWE-940	Improper Verification of Source of a Communication Channel	15
CWE-1230	Exposure of Sensitive Information Through Metadata	15
CWE-1285	Improper Validation of Specified Index, Position, or Offset in Input	15
CWE-799	Improper Control of Interaction Frequency	15
CWE-255	Credentials Management Errors	14
CWE-489	Active Debug Code	14
CWE-696	Incorrect Behavior Order	14
CWE-706	Use of Incorrectly-Resolved Name or Reference	14
CWE-791	Incomplete Filtering of Special Elements	14
CWE-591	Sensitive Data Storage in Improperly Locked Memory	14
CWE-525	Use of Web Browser Cache Containing Sensitive Information	13
CWE-289	Authentication Bypass by Alternate Name	13
CWE-524	Use of Cache Containing Sensitive Information	13
CWE-470	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	13
CWE-614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	13
CWE-325	Missing Cryptographic Step	13
CWE-91	XML Injection (aka Blind XPath Injection)	13
CWE-297	Improper Validation of Certificate with Host Mismatch	13
CWE-124	Buffer Underwrite ('Buffer Underflow')	13
CWE-189	Numeric Errors	13
CWE-825	Expired Pointer Dereference	13
CWE-420	Unprotected Alternate Channel	13
CWE-1385	Missing Origin Validation in WebSockets	13
CWE-697	Incorrect Comparison	12
CWE-300	Channel Accessible by Non-Endpoint	12
CWE-377	Insecure Temporary File	12
CWE-672	Operation on a Resource after Expiration or Release	12
CWE-378	Creation of Temporary File With Insecure Permissions	12
CWE-648	Incorrect Use of Privileged APIs	12
CWE-304	Missing Critical Step in Authentication	12
CWE-84	Improper Neutralization of Encoded URI Schemes in a Web Page	11
CWE-440	Expected Behavior Violation	11
CWE-283	Unverified Ownership	11
CWE-436	Interpretation Conflict	11
CWE-282	Improper Ownership Management	11
CWE-244	Improper Clearing of Heap Memory Before Release ('Heap Inspection')	11
CWE-424	Improper Protection of Alternate Path	10
CWE-691	Insufficient Control Flow Management	10
CWE-540	Inclusion of Sensitive Information in Source Code	10
CWE-353	Missing Support for Integrity Check	10
CWE-340	Generation of Predictable Numbers or Identifiers	10
CWE-226	Sensitive Information in Resource Not Removed Before Reuse	10
CWE-260	Password in Configuration File	10
CWE-279	Incorrect Execution-Assigned Permissions	10
CWE-488	Exposure of Data Element to Wrong Session	10
CWE-402	Transmission of Private Resources into a New Sphere ('Resource Leak')	10
CWE-316	Cleartext Storage of Sensitive Information in Memory	10
CWE-758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior	9
CWE-1394	Use of Default Cryptographic Key	9
CWE-202	Exposure of Sensitive Information Through Data Queries	9
CWE-140	Improper Neutralization of Delimiters	9
CWE-681	Incorrect Conversion between Numeric Types	9
CWE-1295	Debug Messages Revealing Unnecessary Information	9
CWE-1240	Use of a Cryptographic Primitive with a Risky Implementation	9
CWE-114	Process Control	9
CWE-1191	On-Chip Debug and Test Interface With Improper Access Control	9
CWE-526	Cleartext Storage of Sensitive Information in an Environment Variable	9
CWE-763	Release of Invalid Pointer or Reference	9
CWE-776	Improper Restriction of Recursive Entity References in DTDs	9
CWE-96	Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')	9
CWE-261	Weak Encoding for Password	9
CWE-123	Write-what-where Condition	8
CWE-682	Incorrect Calculation	8
CWE-636	Not Failing Securely ('Failing Open')	8
CWE-349	Acceptance of Extraneous Untrusted Data With Trusted Data	8
CWE-477	Use of Obsolete Function	8
CWE-180	Incorrect Behavior Order: Validate Before Canonicalize	8
CWE-606	Unchecked Input for Loop Condition	8
CWE-778	Insufficient Logging	8
CWE-302	Authentication Bypass by Assumed-Immutable Data	8
CWE-286	Incorrect User Management	8
CWE-323	Reusing a Nonce, Key Pair in Encryption	8
CWE-158	Improper Neutralization of Null Byte or NUL Character	8
CWE-268	Privilege Chaining	8
CWE-1050	Excessive Platform Resource Consumption within a Loop	7
CWE-270	Privilege Context Switching Error	7
CWE-215	Insertion of Sensitive Information Into Debugging Code	7
CWE-1004	Sensitive Cookie Without 'HttpOnly' Flag	7
CWE-64	Windows Shortcut Following (.LNK)	7
CWE-183	Permissive List of Allowed Inputs	7
CWE-565	Reliance on Cookies without Validation and Integrity Checking	7
CWE-185	Incorrect Regular Expression	7
CWE-603	Use of Client-Side Authentication	7
CWE-356	Product UI does not Warn User of Unsafe Actions	7
CWE-1289	Improper Validation of Unsafe Equivalence in Input	7
CWE-590	Free of Memory not on the Heap	7
CWE-564	SQL Injection: Hibernate	7
CWE-379	Creation of Temporary File in Directory with Insecure Permissions	7
CWE-782	Exposed IOCTL with Insufficient Access Control	7
CWE-410	Insufficient Resource Pool	7
CWE-1300	Improper Protection of Physical Side Channels	7
CWE-664	Improper Control of a Resource Through its Lifetime	7
CWE-272	Least Privilege Violation	6
CWE-115	Misinterpretation of Input	6
CWE-708	Incorrect Ownership Assignment	6
CWE-87	Improper Neutralization of Alternate XSS Syntax	6
CWE-213	Exposure of Sensitive Information Due to Incompatible Policies	6
CWE-917	Improper Neutralization of Special Elements used in an Expression Language Statement	6
CWE-460	Improper Cleanup on Thrown Exception	6
CWE-830	Inclusion of Web Functionality from an Untrusted Source	6
CWE-27	Path Traversal: 'dir/../../filename'	6
CWE-366	Race Condition within a Thread	6
CWE-1244	Internal Asset Exposed to Unsafe Debug Access Level or State	6
CWE-641	Improper Restriction of Names for Files and Other Resources	6
CWE-322	Key Exchange without Entity Authentication	6
CWE-698	Execution After Redirect (EAR)	6
CWE-83	Improper Neutralization of Script in Attributes in a Web Page	6
CWE-390	Detection of Error Condition Without Action	6
CWE-228	Improper Handling of Syntactically Invalid Structure	6
CWE-176	Improper Handling of Unicode Encoding	6
CWE-1104	Use of Unmaintained Third Party Components	6
CWE-1259	Improper Restriction of Security Token Assignment	6
CWE-549	Missing Password Field Masking	6
CWE-939	Improper Authorization in Handler for Custom URL Scheme	6
CWE-1242	Inclusion of Undocumented Features or Chicken Bits	6
CWE-155	Improper Neutralization of Wildcards or Matching Symbols	5
CWE-350	Reliance on Reverse DNS Resolution for a Security-Critical Action	5
CWE-820	Missing Synchronization	5
CWE-547	Use of Hard-coded, Security-relevant Constants	5
CWE-1327	Binding to an Unrestricted IP Address	5
CWE-156	Improper Neutralization of Whitespace	5
CWE-837	Improper Enforcement of a Single, Unique Action	5
CWE-916	Use of Password Hash With Insufficient Computational Effort	5
CWE-1262	Improper Access Control for Register Interface	5
CWE-471	Modification of Assumed-Immutable Data (MAID)	5
CWE-1275	Sensitive Cookie with Improper SameSite Attribute	5
CWE-197	Numeric Truncation Error	5
CWE-449	The UI Performs the Wrong Action	5
CWE-501	Trust Boundary Violation	5
CWE-385	Covert Timing Channel	5
CWE-296	Improper Following of a Certificate's Chain of Trust	5
CWE-523	Unprotected Transport of Credentials	5
CWE-337	Predictable Seed in Pseudo-Random Number Generator (PRNG)	5
CWE-1384	Improper Handling of Physical or Environmental Conditions	5
CWE-599	Missing Validation of OpenSSL Certificate	5
CWE-1258	Exposure of Sensitive System Information Due to Uncleared Debug Information	5
CWE-357	Insufficient UI Warning of Dangerous Operations	5
CWE-335	Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)	5
CWE-291	Reliance on IP Address for Authentication	5
CWE-241	Improper Handling of Unexpected Data Type	5
CWE-86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages	5
CWE-1025	Comparison Using Wrong Factors	5
CWE-392	Missing Report of Error Condition	5
CWE-909	Missing Initialization of Resource	5
CWE-684	Incorrect Provision of Specified Functionality	4
CWE-19	Data Processing Errors	4
CWE-821	Incorrect Synchronization	4
CWE-271	Privilege Dropping / Lowering Errors	4
CWE-834	Excessive Iteration	4
CWE-177	Improper Handling of URL Encoding (Hex Encoding)	4
CWE-229	Improper Handling of Values	4
CWE-351	Insufficient Type Distinction	4
CWE-759	Use of a One-Way Hash without a Salt	4
CWE-833	Deadlock	4
CWE-1274	Improper Access Control for Volatile Memory Containing Boot Code	4
CWE-625	Permissive Regular Expression	4
CWE-757	Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	4
CWE-170	Improper Null Termination	4
CWE-153	Improper Neutralization of Substitution Characters	4
CWE-647	Use of Non-Canonical URL Paths for Authorization Decisions	4
CWE-1325	Improperly Controlled Sequential Memory Allocation	4
CWE-788	Access of Memory Location After End of Buffer	4
CWE-230	Improper Handling of Missing Values	4
CWE-1088	Synchronous Access of Remote Resource without Timeout	4
CWE-566	Authorization Bypass Through User-Controlled SQL Primary Key	4
CWE-214	Invocation of Process Using Visible Sensitive Information	4
CWE-324	Use of a Key Past its Expiration Date	4
CWE-762	Mismatched Memory Management Routines	4
CWE-1260	Improper Handling of Overlap Between Protected Memory Ranges	4
CWE-783	Operator Precedence Logic Error	4
CWE-707	Improper Neutralization	4
CWE-656	Reliance on Security Through Obscurity	4
CWE-274	Improper Handling of Insufficient Privileges	4
CWE-627	Dynamic Variable Evaluation	4
CWE-394	Unexpected Status Code or Return Value	4
CWE-195	Signed to Unsigned Conversion Error	4
CWE-804	Guessable CAPTCHA	4
CWE-233	Improper Handling of Parameters	4
CWE-657	Violation of Secure Design Principles	4
CWE-223	Omission of Security-relevant Information	3
CWE-308	Use of Single-factor Authentication	3
CWE-646	Reliance on File Name or Extension of Externally-Supplied File	3
CWE-299	Improper Check for Certificate Revocation	3
CWE-242	Use of Inherently Dangerous Function	3
CWE-97	Improper Neutralization of Server-Side Includes (SSI) Within a Web Page	3
CWE-146	Improper Neutralization of Expression/Command Delimiters	3
CWE-67	Improper Handling of Windows Device Names	3
CWE-612	Improper Authorization of Index Containing Sensitive Information	3
CWE-733	Compiler Optimization Removal or Modification of Security-critical Code	3
CWE-187	Partial String Comparison	3
CWE-1326	Missing Immutable Root of Trust in Hardware	3
CWE-790	Improper Filtering of Special Elements	3
CWE-75	Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)	3
CWE-253	Incorrect Check of Function Return Value	3
CWE-1023	Incomplete Comparison with Missing Factors	3
CWE-573	Improper Following of Specification by Caller	3
CWE-275	Permission Issues	3
CWE-551	Incorrect Behavior Order: Authorization Before Parsing and Canonicalization	3
CWE-616	Incomplete Identification of Uploaded File Variables (PHP)	3
CWE-1288	Improper Validation of Consistency within Input	3
CWE-1037	Processor Optimization Removal or Modification of Security-critical Code	3
CWE-645	Overly Restrictive Account Lockout Mechanism	3
CWE-475	Undefined Behavior for Input to API	3
CWE-393	Return of Wrong Status Code	3
CWE-159	Improper Handling of Invalid Use of Special Elements	3
CWE-1281	Sequence of Processor Instructions Leads to Unexpected Behavior	3
CWE-395	Use of NullPointerException Catch to Detect NULL Pointer Dereference	3
CWE-232	Improper Handling of Undefined Values	3
CWE-779	Logging of Excessive Data	3
CWE-771	Missing Reference to Active Allocated Resource	3
CWE-921	Storage of Sensitive Data in a Mechanism without Access Control	3
CWE-1328	Security Version Number Mutable to Older Versions	3
CWE-1257	Improper Access Control Applied to Mirrored or Aliased Memory Regions	2
CWE-138	Improper Neutralization of Special Elements	2
CWE-127	Buffer Under-read	2
CWE-1256	Improper Restriction of Software Interfaces to Hardware Features	2
CWE-1173	Improper Use of Validation Framework	2
CWE-683	Function Call With Incorrect Order of Arguments	2
CWE-826	Premature Release of Resource During Expected Lifetime	2
CWE-480	Use of Incorrect Operator	2
CWE-662	Improper Synchronization	2
CWE-562	Return of Stack Variable Address	2
CWE-453	Insecure Default Variable Initialization	2
CWE-531	Inclusion of Sensitive Information in Test Code	2
CWE-298	Improper Validation of Certificate Expiration	2
CWE-1100	Insufficient Isolation of System-Dependent Functions	2
CWE-167	Improper Handling of Additional Special Element	2
CWE-341	Predictable from Observable State	2
CWE-692	Incomplete Denylist to Cross-Site Scripting	2
CWE-1245	Improper Finite State Machines (FSMs) in Hardware Logic	2
CWE-422	Unprotected Windows Messaging Channel ('Shatter')	2
CWE-1299	Missing Protection Mechanism for Alternate Hardware Interface	2
CWE-643	Improper Neutralization of Data within XPath Expressions ('XPath Injection')	2
CWE-396	Declaration of Catch for Generic Exception	2
CWE-650	Trusting HTTP Permission Methods on the Server Side	2
CWE-1022	Use of Web Link to Untrusted Target with window.opener Access	2
CWE-40	Path Traversal: '\\UNC\share\name\' (Windows UNC Share)	2
CWE-1233	Security-Sensitive Hardware Controls with Missing Lock Bit Protection	2
CWE-1250	Improper Preservation of Consistency Between Independent Representations of Shared State	2
CWE-454	External Initialization of Trusted Variables or Data Stores	2
CWE-924	Improper Enforcement of Message Integrity During Transmission	2
CWE-62	UNIX Hard Link	2
CWE-334	Small Space of Random Values	2
CWE-1234	Hardware Internal or Debug Modes Allow Override of Locks	2
CWE-447	Unimplemented or Unsupported Feature in UI	2
CWE-142	Improper Neutralization of Value Delimiters	2
CWE-1231	Improper Prevention of Lock Bit Modification	2
CWE-1241	Use of Predictable Algorithm in Random Number Generator	2
CWE-780	Use of RSA Algorithm without OAEP	2
CWE-16	Configuration	2
CWE-141	Improper Neutralization of Parameter/Argument Delimiters	2
CWE-730	OWASP Top Ten 2004 Category A9 - Denial of Service	2
CWE-329	Generation of Predictable IV with CBC Mode	2
CWE-836	Use of Password Hash Instead of Password for Authentication	2
CWE-760	Use of a One-Way Hash with a Predictable Salt	2
CWE-118	Incorrect Access of Indexable Resource ('Range Error')	2
CWE-413	Improper Resource Locking	2
CWE-437	Incomplete Model of Endpoint Features	2
CWE-705	Incorrect Control Flow Scoping	2
CWE-605	Multiple Binds to the Same Port	2
CWE-149	Improper Neutralization of Quoting Syntax	2
CWE-1007	Insufficient Visual Distinction of Homoglyphs Presented to User	2
CWE-313	Cleartext Storage in a File or on Disk	2
CWE-399	Resource Management Errors	2
CWE-530	Exposure of Backup File to an Unauthorized Control Sphere	2
CWE-1039	Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism	2
CWE-258	Empty Password in Configuration File	2
CWE-1323	Improper Management of Sensitive Trace Data	2
CWE-81	Improper Neutralization of Script in an Error Message Web Page	2
CWE-491	Public cloneable() Method Without Final ('Object Hijack')	2
CWE-273	Improper Check for Dropped Privileges	2
CWE-539	Use of Persistent Cookies Containing Sensitive Information	2
CWE-164	Improper Neutralization of Internal Special Elements	2
CWE-317	Cleartext Storage of Sensitive Information in GUI	2
CWE-941	Incorrectly Specified Destination in a Communication Channel	2
CWE-1032	OWASP Top Ten 2017 Category A6 - Security Misconfiguration	1
CWE-333	Improper Handling of Insufficient Entropy in TRNG	1
CWE-1038	Insecure Automated Optimizations	1
CWE-1263	Improper Physical Access Control	1
CWE-1395	Dependency on Vulnerable Third-Party Component	1
CWE-1116	Inaccurate Source Code Comments	1
CWE-911	Improper Update of Reference Count	1
CWE-1419	Incorrect Initialization of Resource	1
CWE-690	Unchecked Return Value to NULL Pointer Dereference	1
CWE-414	Missing Lock Check	1
CWE-624	Executable Regular Expression Error	1
CWE-673	External Influence of Sphere Definition	1
CWE-69	Improper Handling of Windows ::DATA Alternate Data Stream	1
CWE-235	Improper Handling of Extra Parameters	1
CWE-838	Inappropriate Encoding for Output Context	1
CWE-412	Unrestricted Externally Accessible Lock	1
CWE-240	Improper Handling of Inconsistent Structural Elements	1
CWE-1189	Improper Isolation of Shared Resources on System-on-a-Chip (SoC)	1
CWE-474	Use of Function with Inconsistent Implementations	1
CWE-1427	Improper Neutralization of Input Used for LLM Prompting	1
CWE-1164	Irrelevant Code	1
CWE-694	Use of Multiple Resources with Duplicate Identifier	1
CWE-166	Improper Handling of Missing Special Element	1
CWE-1329	Reliance on Component That is Not Updateable	1
CWE-544	Missing Standardized Error Handling Mechanism	1
CWE-363	Race Condition Enabling Link Following	1
CWE-85	Doubled Character XSS Manipulations	1
CWE-927	Use of Implicit Intent for Sensitive Communication	1

CWE-79

Cross-site Scripting (XSS)

9101

CWE-862

Missing Authorization

2777

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

2501

CWE-89

SQL Injection

2307