Common Weakness Enumeration

CWE weaknesses

MITRE’s Common Weakness Enumeration names the root causes behind vulnerabilities. Scanners, pentest reports and CVE records cite these IDs. Every CWE that a guide, fix card or lab here cites has a page with MITRE’s definition and the material that covers it; the Top 25 and the weaknesses the guides were written about add prevention basics.

2025 CWE Top 25

MITRE’s list

Ranked by MITRE from CVE Records published from 1 June 2024 to 1 June 2025. Published 11 December 2025.

Rank	Weakness	OWASP Top 10:2025	Guides here
1	CWE-79: Cross-site scripting (XSS)	A05:2025	5
2	CWE-89: SQL injection	A05:2025	2
3	CWE-352: Cross-site request forgery (CSRF)	A01:2025	4
4	CWE-862: Missing authorization	A01:2025	4
5	CWE-787: Out-of-bounds write	—	1
6	CWE-22: Path traversal	A01:2025	1
7	CWE-416: Use after free	—	2
8	CWE-125: Out-of-bounds read	—	2
9	CWE-78: OS command injection	A05:2025	3
10	CWE-94: Code injection	A05:2025	3
11	CWE-120: Classic buffer overflow	—	1
12	CWE-434: Unrestricted file upload	A06:2025	1
13	CWE-476: NULL pointer dereference	A10:2025	1
14	CWE-121: Stack-based buffer overflow	—	1
15	CWE-502: Deserialization of untrusted data	A08:2025	3
16	CWE-122: Heap-based buffer overflow	—	1
17	CWE-863: Incorrect authorization	A01:2025	4
18	CWE-20: Improper input validation	A05:2025	3
19	CWE-284: Improper access control	A01:2025	3
20	CWE-200: Sensitive information exposure	A01:2025	3
21	CWE-306: Missing authentication for a critical function	A07:2025	2
22	CWE-918: Server-side request forgery (SSRF)	A01:2025	2
23	CWE-77: Command injection	A05:2025	2
24	CWE-639: Insecure direct object reference (IDOR)	A01:2025	5
25	CWE-770: Resource allocation without limits	—	8

Every other CWE cited here

Each CWE that a guide, fix card or lab cites has a page: MITRE’s definition from CWE 4.20, and the material here that covers it. A new citation gets its page with the next build.

Weakness	OWASP Top 10:2025	Here
CWE-23: Relative path traversal	A01:2025	1 guide · fix cards
CWE-36: Absolute path traversal	A01:2025	1 guide · fix cards
CWE-59: Link following	A01:2025	2 guides · fix cards
CWE-73: External control of file name or path	A06:2025	1 guide · fix cards · 1 lab
CWE-74: Injection	A05:2025	Related guidance
CWE-88: Argument injection	A05:2025	2 guides · fix cards · 1 lab
CWE-90: LDAP injection	A05:2025	2 guides · fix cards
CWE-91: XML injection (aka blind XPath injection)	A05:2025	fix cards
CWE-93: CRLF injection	A05:2025	1 guide · fix cards
CWE-95: Eval injection	A05:2025	3 guides · fix cards · 1 lab
CWE-98: PHP remote file inclusion	A05:2025	1 guide
CWE-113: HTTP request/response splitting	A05:2025	1 guide · fix cards
CWE-116: Improper encoding or escaping of output	A05:2025	2 guides
CWE-117: Log injection	A09:2025	2 guides · fix cards
CWE-119: Improper restriction of operations within the bounds of a memory buffer	—	1 guide
CWE-129: Improper validation of array index	A05:2025	1 guide
CWE-130: Improper handling of length parameter inconsistency	—	1 guide · 1 lab
CWE-180: Incorrect behavior order: validate before canonicalize	—	1 guide
CWE-190: Integer overflow or wraparound	—	2 guides
CWE-204: Observable response discrepancy	—	3 guides
CWE-208: Observable timing discrepancy	—	4 guides
CWE-209: Sensitive data in error messages	A10:2025	2 guides
CWE-213: Exposure of sensitive information due to incompatible policies	—	1 guide
CWE-215: Sensitive information in debugging code	A10:2025	1 guide
CWE-235: Improper handling of extra parameters	A10:2025	1 guide
CWE-250: Unnecessary privileges	—	9 guides · 1 lab
CWE-257: Storing passwords in a recoverable format	—	1 guide
CWE-260: Password in configuration file	A02:2025	fix cards
CWE-261: Weak encoding for password	A04:2025	fix cards
CWE-269: Improper privilege management	A06:2025	1 guide
CWE-275: Permission issues	—	1 guide
CWE-285: Improper authorization	A01:2025	1 lab
CWE-287: Improper authentication	A07:2025	2 guides · fix cards · 2 labs
CWE-288: Authentication bypass using an alternate path or channel	A07:2025	1 guide
CWE-290: Authentication bypass by spoofing	A07:2025	6 guides
CWE-294: Authentication bypass by capture-replay	A07:2025	10 guides · 1 lab
CWE-295: Improper certificate validation	A07:2025	10 guides · fix cards
CWE-296: Improper following of a certificate's chain of trust	A04:2025	fix cards
CWE-297: Improper validation of certificate with host mismatch	A07:2025	1 guide · fix cards
CWE-298: Improper validation of certificate expiration	A07:2025	2 guides
CWE-307: Improper restriction of excessive authentication attempts	A07:2025	3 guides
CWE-308: Use of single-factor authentication	A07:2025	3 guides
CWE-311: Missing encryption of sensitive data	A06:2025	1 guide
CWE-312: Cleartext storage of sensitive information	A06:2025	4 guides
CWE-319: Cleartext transmission of sensitive information	A04:2025	5 guides
CWE-321: Use of hard-coded cryptographic key	A04:2025	2 guides
CWE-323: Reusing a nonce, key pair in encryption	A04:2025	4 guides · 1 lab
CWE-324: Use of a key past its expiration date	A04:2025	3 guides
CWE-326: Inadequate encryption strength	A04:2025	8 guides
CWE-327: Broken or risky crypto algorithm	A04:2025	13 guides · fix cards · 1 lab
CWE-328: Use of weak hash	A04:2025	4 guides
CWE-330: Use of insufficiently random values	A04:2025	fix cards · 1 lab
CWE-331: Insufficient entropy	A04:2025	1 guide · 1 lab
CWE-338: Use of cryptographically weak pseudo-random number generator (PRNG)	A04:2025	1 guide · fix cards · 1 lab
CWE-345: Insufficient verification of data authenticity	A08:2025	1 guide · 3 labs
CWE-346: Origin validation error	A07:2025	6 guides · fix cards
CWE-347: Improper signature verification	A04:2025	11 guides · fix cards · 1 lab
CWE-348: Use of less trusted source	—	1 guide
CWE-349: Acceptance of extraneous untrusted data with trusted data	—	2 guides
CWE-353: Missing support for integrity check	A08:2025	3 guides
CWE-359: Exposure of private personal information to an unauthorized actor	A01:2025	5 guides
CWE-362: Race condition	A06:2025	4 guides · 1 lab
CWE-367: Time-of-check time-of-use (TOCTOU) race condition	—	4 guides · 1 lab
CWE-377: Insecure temporary file	A01:2025	1 guide
CWE-379: Creation of temporary file in directory with insecure permissions	A01:2025	1 guide
CWE-384: Session fixation	A07:2025	1 guide · fix cards
CWE-400: Uncontrolled resource consumption	—	8 guides · fix cards
CWE-409: Improper handling of highly compressed data (data amplification)	—	2 guides
CWE-427: Uncontrolled search path element	A08:2025	1 guide
CWE-436: Interpretation conflict	A06:2025	1 guide
CWE-441: Confused deputy	A01:2025	3 guides
CWE-444: HTTP request smuggling	A06:2025	2 guides
CWE-460: Improper cleanup on thrown exception	A10:2025	1 guide
CWE-472: External control of assumed-immutable web parameter	A06:2025	1 guide · 1 lab
CWE-489: Active debug code	A02:2025	3 guides
CWE-494: Code download without integrity check	A08:2025	13 guides
CWE-497: Exposure of sensitive system information to an unauthorized control sphere	A01:2025	1 guide
CWE-501: Trust boundary violation	A06:2025	1 guide
CWE-506: Embedded malicious code	A08:2025	12 guides
CWE-521: Weak password requirements	A07:2025	2 guides
CWE-522: Insufficiently protected credentials	A06:2025	11 guides
CWE-524: Sensitive data in a shared cache	—	1 guide
CWE-527: Exposure of version-control repository to an unauthorized control sphere	—	1 guide
CWE-532: Sensitive data in log files	A09:2025	11 guides
CWE-538: Insertion of sensitive information into externally-accessible file or directory	A01:2025	2 guides
CWE-540: Inclusion of sensitive information in source code	A01:2025	1 guide
CWE-548: Directory listing	A01:2025	1 guide
CWE-601: Open redirect	A01:2025	4 guides · fix cards · 2 labs
CWE-602: Client-Side enforcement of server-side security	A06:2025	3 guides
CWE-611: XML external entities (XXE)	A02:2025	4 guides · fix cards · 1 lab
CWE-613: Insufficient session expiration	A07:2025	5 guides · fix cards
CWE-614: Cookie without Secure attribute	A02:2025	2 guides · fix cards
CWE-617: Reachable assertion	—	1 guide
CWE-636: Failing open	A10:2025	2 guides
CWE-640: Weak password recovery mechanism for forgotten password	A07:2025	4 guides · 1 lab
CWE-643: XPath injection	A05:2025	1 guide · fix cards
CWE-646: Reliance on file name or extension of externally-supplied file	A06:2025	fix cards · 1 lab
CWE-653: Improper isolation or compartmentalization	A06:2025	2 guides
CWE-656: Reliance on security through obscurity	A06:2025	1 guide
CWE-657: Violation of secure design principles	A06:2025	1 guide
CWE-665: Improper initialization	—	1 guide
CWE-668: Exposure of resource to wrong sphere	A01:2025	1 lab
CWE-674: Uncontrolled recursion	—	1 guide
CWE-682: Incorrect calculation	—	1 guide
CWE-732: Incorrect permission assignment for critical resource	A01:2025	5 guides
CWE-749: Exposed dangerous method or function	A01:2025	3 guides
CWE-757: Algorithm downgrade	A04:2025	3 guides
CWE-758: Reliance on undefined, unspecified, or implementation-defined behavior	—	1 guide
CWE-759: Use of a one-way hash without a salt	A04:2025	1 guide · fix cards · 1 lab
CWE-760: Use of a one-way hash with a predictable salt	A04:2025	1 guide
CWE-762: Mismatched memory management routines	—	1 guide
CWE-776: XML entity expansion	A02:2025	1 guide · fix cards · 1 lab
CWE-777: Regular expression without anchors	—	1 guide
CWE-778: Insufficient logging	A09:2025	7 guides
CWE-798: Use of hard-coded credentials	A07:2025	10 guides · fix cards
CWE-799: Improper control of interaction frequency	A06:2025	1 guide
CWE-829: Inclusion of untrusted functionality	A08:2025	16 guides
CWE-837: Improper enforcement of a single, unique action	—	2 guides · 1 lab
CWE-839: Numeric range comparison without minimum check	—	1 guide
CWE-841: Improper enforcement of behavioral workflow	A06:2025	3 guides
CWE-912: Hidden functionality	—	2 guides
CWE-915: Mass assignment	A08:2025	5 guides · fix cards · 1 lab
CWE-916: Weak password hashing	A04:2025	3 guides · fix cards · 1 lab
CWE-917: Expression language injection	A05:2025	4 guides
CWE-922: Insecure storage of sensitive information	A01:2025	2 guides
CWE-926: Improper export of Android application components	A08:2025	3 guides
CWE-927: Use of implicit intent for sensitive communication	—	1 guide
CWE-939: Improper authorization in handler for custom URL scheme	—	4 guides
CWE-940: Improper verification of source of a communication channel	A07:2025	2 guides
CWE-942: Permissive CORS policy	A02:2025	1 guide · fix cards · 1 lab
CWE-943: Improper neutralization of special elements in data query logic	—	2 guides · fix cards
CWE-1004: Cookie without HttpOnly flag	A02:2025	2 guides · fix cards
CWE-1021: Improper restriction of rendered UI layers or frames	A06:2025	2 guides · fix cards · 1 lab
CWE-1104: Use of unmaintained third party components	A03:2025	7 guides
CWE-1188: Initialization of a resource with an insecure default	—	6 guides
CWE-1236: Improper neutralization of formula elements in a CSV file	—	2 guides · fix cards
CWE-1240: Use of a cryptographic primitive with a risky implementation	A04:2025	1 guide
CWE-1265: Unintended reentrant invocation of non-reentrant code via nested calls	—	1 guide
CWE-1275: Improper SameSite cookie attribute	A01:2025	2 guides · fix cards
CWE-1277: Firmware not updateable	—	1 guide
CWE-1284: Improper validation of specified quantity in input	—	2 guides · 1 lab
CWE-1287: Improper validation of specified type of input	—	2 guides
CWE-1321: Prototype pollution	—	1 guide
CWE-1329: Reliance on component that is not updateable	A03:2025	1 guide
CWE-1333: Inefficient regular expression complexity	—	1 guide · fix cards
CWE-1336: Server-side template injection	—	3 guides · fix cards · 1 lab
CWE-1357: Untrustworthy components	A03:2025	10 guides
CWE-1385: Missing origin validation in WebSockets	—	1 guide
CWE-1390: Weak authentication	A07:2025	1 guide
CWE-1392: Use of default credentials	A07:2025	1 guide
CWE-1395: Dependency on vulnerable third-party component	A03:2025	7 guides · 1 lab
CWE-1426: Improper validation of generative AI output	—	1 guide
CWE-1427: Improper neutralization of input used for LLM prompting	—	7 guides

Sources

Entries from 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program). “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.

Names and definitions are from MITRE’s CWE 4.20 catalogue, released 30 April 2026. Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.