CWE vulnerability classesVulnerability classes.The bug behind every CVE.

CVEs change; bug patterns repeat. Each class covers the root cause, vulnerable and fixed code, and prevention steps.

Classes covered in depth

Root cause, representative vulnerable/fixed code and prevention steps written by our team.

CWE-79Cross-site scriptingUser content is inserted into the page as HTML. The browser interprets the content as code rather than data.49,650 CVEs · top score 99
CWE-89SQL injectionThe query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.17,923 CVEs · top score 99
CWE-200Exposure of sensitive information to an unauthorized actorThe extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.11,599 CVEs · top score 94
CWE-22Path traversalA user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.10,715 CVEs · top score 100
CWE-352Cross-site request forgeryState-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.9,678 CVEs · top score 95
CWE-416Use after freeAfter a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.9,429 CVEs · top score 99
CWE-78OS command injectionUser input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.6,307 CVEs · top score 100
CWE-287Improper authenticationAuthentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.4,927 CVEs · top score 99
CWE-400Uncontrolled resource consumptionCode that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.4,079 CVEs · top score 90
CWE-120Buffer copy without bounds checkingWhen data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.3,698 CVEs · top score 99
CWE-269Improper privilege managementTo simplify setup, a service account is granted broad, cluster-wide permissions. The principle of least privilege is skipped during installation.3,557 CVEs · top score 97
CWE-502Deserialization of untrusted dataData received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.3,381 CVEs · top score 100
CWE-639Authorization bypass through user-controlled keyThe endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.3,155 CVEs · top score 66
CWE-306Missing authentication for critical functionA function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”3,066 CVEs · top score 100
CWE-295Improper certificate validationA certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.1,683 CVEs · top score 90
CWE-798Hard-coded credentialsFor convenience in support or manufacturing, an account that is identical on every device is embedded in the software. Credentials learned from one device work on all of them.1,577 CVEs · top score 98
CWE-347Improper verification of cryptographic signatureThe verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.898 CVEs · top score 92

Most frequent classes in the database

CWE distribution of published records. Click a class to list every CVE in it.