Vulnerability classes.The bug behind every CVE.

CVEs change; bug patterns repeat. Each class covers the root cause, vulnerable and fixed code, and prevention steps.

Classes covered in depth

Root cause, representative vulnerable/fixed code and prevention steps written by our team.

CWE-79Cross-site scriptingUser content is inserted into the page as HTML. The browser interprets the content as code rather than data.47,649 CVEs · top score 99
CWE-89SQL injectionThe query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.17,346 CVEs · top score 99
CWE-200Exposure of sensitive information to an unauthorized actorThe extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.10,849 CVEs · top score 94
CWE-22Path traversalA user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.9,994 CVEs · top score 100
CWE-352Cross-site request forgeryState-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.9,466 CVEs · top score 95
CWE-416Use after freeAfter a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.8,147 CVEs · top score 99
CWE-78OS command injectionUser input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.5,951 CVEs · top score 100
CWE-287Improper authenticationAuthentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.4,533 CVEs · top score 99
CWE-400Uncontrolled resource consumptionCode that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.3,675 CVEs · top score 90
CWE-120Buffer copy without bounds checkingWhen data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.3,626 CVEs · top score 99
CWE-269Improper privilege managementTo simplify setup, a service account is granted broad, cluster-wide permissions. The principle of least privilege is skipped during installation.3,258 CVEs · top score 97
CWE-502Deserialization of untrusted dataData received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.3,045 CVEs · top score 100
CWE-306Missing authentication for critical functionA function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”2,686 CVEs · top score 100
CWE-639Authorization bypass through user-controlled keyThe endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.2,471 CVEs · top score 66
CWE-798Hard-coded credentialsFor convenience in support or manufacturing, an account that is identical on every device is embedded in the software. Credentials learned from one device work on all of them.1,511 CVEs · top score 98
CWE-295Improper certificate validationA certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.1,502 CVEs · top score 90
CWE-347Improper verification of cryptographic signatureThe verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.799 CVEs · top score 89

Most frequent classes in the database

CWE distribution of published records. Click a class to list every CVE in it.