LIVE NEWSROOM · --:-- · May 24, 2026
A LIBRARY FOR SECURITY RESEARCHERS

COMMON WEAKNESS ENUMERATION

Software
weaknesses.

The CWE Top 25 Most Dangerous plus other common weakness types — each explained in plain English with impact, mitigations, and real CVE examples. Cross-linked to the KEV catalog and ATT&CK matrix.

CWE Top 25 Most Dangerous

CWE-787
Out-of-bounds Write
CWE-79
Cross-site Scripting (XSS)
CWE-89
SQL Injection
CWE-416
Use After Free
CWE-78
OS Command Injection
CWE-20
Improper Input Validation
CWE-125
Out-of-bounds Read
CWE-22
Path Traversal
CWE-352
Cross-Site Request Forgery (CSRF)
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-862
Missing Authorization
CWE-476
NULL Pointer Dereference
CWE-287
Improper Authentication
CWE-190
Integer Overflow or Wraparound
CWE-502
Deserialization of Untrusted Data
CWE-77
Command Injection
CWE-119
Improper Restriction of Operations within Memory Buffer
CWE-798
Use of Hard-coded Credentials
CWE-918
Server-Side Request Forgery (SSRF)
CWE-306
Missing Authentication for Critical Function
CWE-362
Race Condition
CWE-269
Improper Privilege Management
CWE-94
Code Injection
CWE-863
Incorrect Authorization
CWE-276
Incorrect Default Permissions

Other common weaknesses

CWE-200
Exposure of Sensitive Information
CWE-611
XML External Entity (XXE)
CWE-400
Uncontrolled Resource Consumption
CWE-522
Insufficiently Protected Credentials
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE-295
Improper Certificate Validation
CWE-601
Open Redirect
CWE-384
Session Fixation
CWE-209
Sensitive Information in Error Message
CWE-311
Missing Encryption of Sensitive Data
CWE-326
Inadequate Encryption Strength
CWE-770
Allocation of Resources Without Limits
CWE-74
Injection
CWE-668
Exposure of Resource to Wrong Sphere
CWE-285
Improper Authorization
CWE-1321
Prototype Pollution
CWE-88
Argument Injection
CWE-90
LDAP Injection
CWE-444
HTTP Request Smuggling
CWE-312
Cleartext Storage of Sensitive Information
CWE-426
Untrusted Search Path
CWE-116
Improper Encoding or Escaping of Output
CWE-1236
Formula Injection (CSV Injection)
CWE-639
Authorization Bypass Through User-Controlled Key (IDOR)
CWE-613
Insufficient Session Expiration
Scroll to Top