CWE Lookup

Search Common Weakness Enumerations (CWE) by number.



MITRE 2024 Top 25 CWEs

List of top most critical software weaknesses. Only Common Weakness Enumerations (CWEs) that are detectable from client-side software packages and libraries are included.
CWEDescriptionWebsites
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')16,918,796
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')5,106,860
CWE-20Improper Input Validation2,331,621
CWE-125Out-of-bounds Read7,058,909
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')318,940
CWE-416Use After Free5,913,105
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3,445,326
CWE-352Cross-Site Request Forgery (CSRF)4,437,231
CWE-434Unrestricted Upload of File with Dangerous Type6,668,106
CWE-862Missing Authorization6,614,731
CWE-476NULL Pointer Dereference5,471,540
CWE-287Improper Authentication2,279,689
CWE-190Integer Overflow or Wraparound6,622,705
CWE-502Deserialization of Untrusted Data1,489,064
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')11,111
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer125,377
CWE-798Use of Hard-coded Credentials228
CWE-918Server-Side Request Forgery (SSRF)5,116,408
CWE-306Missing Authentication for Critical Function2,247,260
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')30,959
CWE-269Improper Privilege Management3,184,857
CWE-94Improper Control of Generation of Code ('Code Injection')4,066,032
CWE-863Incorrect Authorization2,078,999
CWE-276Incorrect Default Permissions3,228
CWE-200Exposure of Sensitive Information to an Unauthorized Actor8,413,921

Most recently updated CWEs

CWE with mostly recently updated or discovered CVE vulnerabilities. Only Common Weakness Enumerations (CWEs) that are detectable from client-side software packages and libraries are included.
CWEDescriptionUpdated
CWE-269Improper Privilege ManagementOct 15, 2026
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Oct 15, 2026
CWE-434Unrestricted Upload of File with Dangerous TypeOct 15, 2026
CWE-200Exposure of Sensitive Information to an Unauthorized ActorOct 15, 2026
CWE-918Server-Side Request Forgery (SSRF)Oct 15, 2026
CWE-863Incorrect AuthorizationOct 15, 2026
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Oct 15, 2026
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Oct 15, 2026
CWE-94Improper Control of Generation of Code ('Code Injection')Oct 15, 2026

Most prevalent CWEs

The list of most widespread CWEs. Only Common Weakness Enumerations (CWEs) that are detectable from client-side software packages and libraries are included.
CWEDescriptionWebsites
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')16,918,796
CWE-200Exposure of Sensitive Information to an Unauthorized Actor8,413,921
CWE-201Insertion of Sensitive Information Into Sent Data7,900,488
CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')7,207,200
CWE-125Out-of-bounds Read7,058,909
CWE-434Unrestricted Upload of File with Dangerous Type6,668,106
CWE-190Integer Overflow or Wraparound6,622,705
CWE-862Missing Authorization6,614,731
CWE-416Use After Free5,913,105
CWE-476NULL Pointer Dereference5,471,540