Weaknesses

Common Weakness Enumeration (CWE) — a catalogue of software and hardware weakness types. This list only includes weaknesses that the National Vulnerability Database (NVD) assigns to CVEs, not the full CWE catalogue.

What is a CWE? — Click to learn more

What is a CWE?

A CWE (Common Weakness Enumeration) is a named category of programming mistake — things like storing passwords insecurely or trusting user input without checking it first. Where a CVE is a specific security flaw found in a real product, a CWE is the type of mistake that caused it. The same type of mistake can affect thousands of different products from completely different vendors.

Why does it matter?

A CVE tells you something is broken. A CWE tells you why. If the same type of mistake keeps appearing across different products, fixing each one individually misses the point — the underlying habit or pattern needs to change. CWEs help organisations understand whether they have a one-off problem or a recurring one.

Who maintains the CWE list?

CWEs are maintained by MITRE, a U.S. non-profit organization. They are used as a shared language between software developers, security researchers, and auditors worldwide.

Search weaknesses
130 / 130
CWE IDName
CWE-1021Improper Restriction of Rendered UI Layers or Frames
CWE-116Improper Encoding or Escaping of Output
CWE-1188Initialization of a Resource with an Insecure Default
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-1236Improper Neutralization of Formula Elements in a CSV File
CWE-125Out-of-bounds Read
CWE-1284Improper Validation of Specified Quantity in Input
CWE-129Improper Validation of Array Index
CWE-131Incorrect Calculation of Buffer Size
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1333Inefficient Regular Expression Complexity
CWE-134Use of Externally-Controlled Format String
CWE-178Improper Handling of Case Sensitivity
CWE-190Integer Overflow or Wraparound
CWE-191Integer Underflow (Wrap or Wraparound)
CWE-193Off-by-one Error
CWE-20Improper Input Validation
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
CWE-203Observable Discrepancy
CWE-209Generation of Error Message Containing Sensitive Information
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-252Unchecked Return Value
CWE-269Improper Privilege Management
CWE-273Improper Check for Dropped Privileges
CWE-276Incorrect Default Permissions
CWE-281Improper Preservation of Permissions
CWE-287Improper Authentication
CWE-290Authentication Bypass by Spoofing
CWE-294Authentication Bypass by Capture-replay
CWE-295Improper Certificate Validation
CWE-306Missing Authentication for Critical Function
CWE-307Improper Restriction of Excessive Authentication Attempts
CWE-311Missing Encryption of Sensitive Data
CWE-312Cleartext Storage of Sensitive Information
CWE-319Cleartext Transmission of Sensitive Information
CWE-326Inadequate Encryption Strength
CWE-327Use of a Broken or Risky Cryptographic Algorithm
CWE-330Use of Insufficiently Random Values
CWE-331Insufficient Entropy
CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-347Improper Verification of Cryptographic Signature
CWE-352Cross-Site Request Forgery (CSRF)
CWE-354Improper Validation of Integrity Check Value
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-369Divide By Zero
CWE-384Session Fixation
CWE-400Uncontrolled Resource Consumption
CWE-401Missing Release of Memory after Effective Lifetime
CWE-404Improper Resource Shutdown or Release
CWE-407Inefficient Algorithmic Complexity
CWE-415Double Free
CWE-416Use After Free
CWE-425Direct Request ('Forced Browsing')
CWE-426Untrusted Search Path
CWE-427Uncontrolled Search Path Element
CWE-428Unquoted Search Path or Element
CWE-434Unrestricted Upload of File with Dangerous Type
CWE-436Interpretation Conflict
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-459Incomplete Cleanup
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-476NULL Pointer Dereference
CWE-494Download of Code Without Integrity Check
CWE-502Deserialization of Untrusted Data
CWE-521Weak Password Requirements
CWE-522Insufficiently Protected Credentials
CWE-532Insertion of Sensitive Information into Log File
CWE-552Files or Directories Accessible to External Parties
CWE-565Reliance on Cookies without Validation and Integrity Checking
CWE-59Improper Link Resolution Before File Access ('Link Following')
CWE-601URL Redirection to Untrusted Site ('Open Redirect')
CWE-610Externally Controlled Reference to a Resource in Another Sphere
CWE-611Improper Restriction of XML External Entity Reference
CWE-613Insufficient Session Expiration
CWE-617Reachable Assertion
CWE-639Authorization Bypass Through User-Controlled Key
CWE-640Weak Password Recovery Mechanism for Forgotten Password
CWE-662Improper Synchronization
CWE-665Improper Initialization
CWE-667Improper Locking
CWE-668Exposure of Resource to Wrong Sphere
CWE-669Incorrect Resource Transfer Between Spheres
CWE-670Always-Incorrect Control Flow Implementation
CWE-672Operation on a Resource after Expiration or Release
CWE-674Uncontrolled Recursion
CWE-681Incorrect Conversion between Numeric Types
CWE-682Incorrect Calculation
CWE-697Incorrect Comparison
CWE-704Incorrect Type Conversion or Cast
CWE-706Use of Incorrectly-Resolved Name or Reference
CWE-732Incorrect Permission Assignment for Critical Resource
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-754Improper Check for Unusual or Exceptional Conditions
CWE-755Improper Handling of Exceptional Conditions
CWE-763Release of Invalid Pointer or Reference
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-770Allocation of Resources Without Limits or Throttling
CWE-772Missing Release of Resource after Effective Lifetime
CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-787Out-of-bounds Write
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-798Use of Hard-coded Credentials
CWE-824Access of Uninitialized Pointer
CWE-829Inclusion of Functionality from Untrusted Control Sphere
CWE-834Excessive Iteration
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-838Inappropriate Encoding for Output Context
CWE-843Access of Resource Using Incompatible Type ('Type Confusion')
CWE-862Missing Authorization
CWE-863Incorrect Authorization
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-908Use of Uninitialized Resource
CWE-909Missing Initialization of Resource
CWE-91XML Injection (aka Blind XPath Injection)
CWE-913Improper Control of Dynamically-Managed Code Resources
CWE-916Use of Password Hash With Insufficient Computational Effort
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE-918Server-Side Request Forgery (SSRF)
CWE-920Improper Restriction of Power Consumption
CWE-922Insecure Storage of Sensitive Information
CWE-924Improper Enforcement of Message Integrity During Transmission in a Communication Channel
CWE-94Improper Control of Generation of Code ('Code Injection')