CWE Lookup

Search Common Weakness Enumerations (CWE) by number.



MITRE 2024 Top 25 CWEs

List of top most critical software weaknesses. Only Common Weakness Enumerations (CWEs) that are detectable from client-side software packages and libraries are included.
CWEDescriptionWebsites
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')17,562,641
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')8,852,712
CWE-20Improper Input Validation2,474,107
CWE-125Out-of-bounds Read6,714,617
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')235,022
CWE-416Use After Free6,278,514
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3,983,257
CWE-352Cross-Site Request Forgery (CSRF)2,154,396
CWE-434Unrestricted Upload of File with Dangerous Type3,819,606
CWE-862Missing Authorization6,732,349
CWE-476NULL Pointer Dereference5,856,039
CWE-287Improper Authentication2,163,177
CWE-190Integer Overflow or Wraparound5,403,923
CWE-502Deserialization of Untrusted Data1,287,503
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')4,943
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer142,579
CWE-798Use of Hard-coded Credentials232
CWE-918Server-Side Request Forgery (SSRF)4,575,184
CWE-306Missing Authentication for Critical Function123,739
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')33,552
CWE-269Improper Privilege Management2,895,484
CWE-94Improper Control of Generation of Code ('Code Injection')3,022,686
CWE-863Incorrect Authorization2,649,138
CWE-276Incorrect Default Permissions4,367
CWE-200Exposure of Sensitive Information to an Unauthorized Actor5,788,602

Most recently updated CWEs

CWE with mostly recently updated or discovered CVE vulnerabilities. Only Common Weakness Enumerations (CWEs) that are detectable from client-side software packages and libraries are included.
CWEDescriptionUpdated
CWE-20Improper Input ValidationJul 30, 2026
CWE-787Out-of-bounds WriteJul 30, 2026
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Jul 30, 2026
CWE-434Unrestricted Upload of File with Dangerous TypeJul 30, 2026
CWE-200Exposure of Sensitive Information to an Unauthorized ActorJul 30, 2026
CWE-94Improper Control of Generation of Code ('Code Injection')Jul 30, 2026
CWE-863Incorrect AuthorizationJul 30, 2026
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Jul 30, 2026
CWE-352Cross-Site Request Forgery (CSRF)Jul 30, 2026

Most prevalent CWEs

The list of most widespread CWEs. Only Common Weakness Enumerations (CWEs) that are detectable from client-side software packages and libraries are included.
CWEDescriptionWebsites
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')17,562,641
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')8,852,712
CWE-862Missing Authorization6,732,349
CWE-125Out-of-bounds Read6,714,617
CWE-416Use After Free6,278,514
CWE-476NULL Pointer Dereference5,856,039
CWE-200Exposure of Sensitive Information to an Unauthorized Actor5,788,602
CWE-190Integer Overflow or Wraparound5,403,923
CWE-436Interpretation Conflict4,792,909
CWE-918Server-Side Request Forgery (SSRF)4,575,184