CWE Weakness Guides: How Each Happens and How to Fix It

The Common Weakness Enumeration names the kinds of mistakes that become vulnerabilities. This index links a guide for each weakness, with how it happens, how to find it and how to fix it.

Key takeaways

• 944 guides, each written for defenders and based on the source record.
• Each guide follows the MITRE CWE entry and links to its Gold page.
• Start with the free dependency scan at gold.safeguard.sh/scan if you want a quick look at your own packages.

All guides

• CWE-1004 Sensitive Cookie Without HttpOnly: Cause and Fix
• CWE-1007 Homoglyph Spoofing: Lookalike Characters That Fool Users
• CWE-102 Struts Duplicate Validation Forms Explained
• CWE-1021 Clickjacking: Restricting UI Frames and Layers
• CWE-1022 window.opener Tabnabbing: Cause and Fix
• CWE-1023 Incomplete Comparison with Missing Factors
• CWE-1024 Comparison of Incompatible Types in Code
• CWE-1025 Comparison Using Wrong Factors: Reference vs Value
• CWE-103 Struts Incomplete validate() Method: Fix It
• CWE-1037 Processor Optimizations That Bypass Security Checks
• CWE-1038 Insecure Automated Optimizations: When Compilers Undo Security
• CWE-1039 Adversarial Inputs Against ML Recognition: Risks and Defenses
• CWE-104 Struts Form Bean Without a Validation Class
• CWE-1041 Use of Redundant Code: Why Copies Hide Bugs
• CWE-1042 Static Member Data Outside a Singleton Class
• CWE-1043 Data Element With Too Many Non-Primitive Elements
• CWE-1044 Architecture With Too Many or Too Few Layers
• CWE-1045 Virtual Destructor Missing in a Child Class
• CWE-1046 Building Strings by Concatenation in Loops
• CWE-1047 Modules With Circular Dependencies
• CWE-1048 Functions With a Large Number of Outward Calls
• CWE-1049 Excessive Data Query Operations on Large Tables
• CWE-105 Struts Form Field Without Validator: Close the Gap
• CWE-1050 Excessive Platform Resource Use Inside a Loop
• CWE-1051 Hard-Coded Network Resource Configuration Data
• CWE-1052 Excessive Use of Hard-Coded Literals in Initialization
• CWE-1053 Missing Documentation for Design: Why It Matters
• CWE-1054 Invocation at an Unnecessarily Deep Layer: Explained
• CWE-1055 Multiple Inheritance from Concrete Classes: Risks and Fixes
• CWE-1056 Variadic Parameters: Reliability Risks and How to Avoid Them
• CWE-1057 Data Access Outside the Data Manager Component
• CWE-1058 Non-Final Static Members in Multi-Threaded Code
• CWE-1059 Insufficient Technical Documentation: The Security Cost
• CWE-106 Struts: Why You Need an Input Validation Framework
• CWE-1060 Excessive Inefficient Server-Side Data Accesses
• CWE-1061 Insufficient Encapsulation: How It Happens and How to Fix It
• CWE-1062 Parent Class with References to a Child Class
• CWE-1063 Creating a Class Instance in a Static Code Block
• CWE-1064 Functions with Too Many Parameters: Risks and Fixes
• CWE-1065 Low-Level Resource Management in App Server Components
• CWE-1066 Missing Serialization Control Element
• CWE-1067 Excessive Sequential Searches of a Data Resource
• CWE-1068 Implementation Inconsistent with Documented Design
• CWE-1069 Empty Exception Block: Why Swallowed Errors Hurt
• CWE-107 Struts Unused Validation Form: A Maintenance Signal
• CWE-1070 Serializable Element Containing Non-Serializable Items
• CWE-1071 Empty Code Block: Incomplete Code and How to Spot It
• CWE-1072 Database Access Without Connection Pooling
• CWE-1073 Excessive Data Accesses in Client Code: Causes and Fixes
• CWE-1074 Class with Excessively Deep Inheritance: What to Do
• CWE-1075 Unconditional Control Transfer Outside a Switch Block
• CWE-1076 Insufficient Adherence to Expected Conventions
• CWE-1077 Floating Point Comparison with Incorrect Operator
• CWE-1078 Inappropriate Source Code Style: Why Formatting Matters
• CWE-1079 Parent Class Without Virtual Destructor Explained
• CWE-108 Struts Unvalidated Action Form: Map Every Form
• CWE-1080 Source Files With Excessive Lines of Code
• CWE-1082 Class Instance Self Destruction: Delete This Explained
• CWE-1083 Data Access Outside the Expected Data Manager
• CWE-1084 Functions With Too Many File or Data Access Operations
• CWE-1085 Excessive Commented Out Code in Functions
• CWE-1086 Classes With Too Many Child Classes
• CWE-1087 Virtual Method Without a Virtual Destructor in C++
• CWE-1088 Synchronous Remote Calls Without a Timeout
• CWE-1089 Large Data Tables With Too Many Indices
• CWE-109 Struts Validator Turned Off: Check validate=true
• CWE-1090 Methods That Reach Into Another Class's Members
• CWE-1091 Use of Object Without Invoking Its Destructor
• CWE-1092 Same Control Element Used in Multiple Layers
• CWE-1093 Excessively Complex Data Representation
• CWE-1094 Excessive Index Range Scans on Large Tables
• CWE-1095 Loop Condition Value Updated Inside the Loop
• CWE-1096 Singleton Creation Without Synchronization
• CWE-1097 Storable Data Without Comparison Functions
• CWE-1098 Pointer Member Without Copy Control in C++ Classes
• CWE-1099 Inconsistent Naming Conventions for Identifiers
• CWE-11 ASP.NET Debug Binary in Production: Why It Matters
• CWE-110 Struts Validator Without Form Field: Keep Rules in Sync
• CWE-1100 Insufficient Isolation of System Dependent Functions
• CWE-1101 Reliance on Runtime Component in Generated Code
• CWE-1102 Reliance on Machine Dependent Data Representation
• CWE-1103 Platform Dependent Third Party Components
• CWE-1104 Unmaintained Third Party Components: Risk and Fixes
• CWE-1105 Insufficient Encapsulation of Machine-Dependent Code
• CWE-1106 Insufficient Use of Symbolic Constants Explained
• CWE-1107 Insufficient Isolation of Symbolic Constant Definitions
• CWE-1108 Excessive Reliance on Global Variables: What to Do
• CWE-1109 Using One Variable for Multiple Purposes: Why It Bites
• CWE-111 Unsafe JNI: Native Code Inside Java Apps
• CWE-1110 Incomplete Design Documentation and Why Reviewers Care
• CWE-1111 Incomplete I/O Documentation: Inputs and Outputs Matter
• CWE-1112 Incomplete Documentation of Program Execution
• CWE-1113 Inappropriate Comment Style: A Quality Weakness Explained
• CWE-1114 Inappropriate Whitespace Style and the goto fail Bug
• CWE-1115 Source Code Element without Standard Prologue
• CWE-1116 Inaccurate Source Code Comments: A Review Hazard
• CWE-1117 Callable with Insufficient Behavioral Summary
• CWE-1118 Insufficient Documentation of Error Handling Techniques
• CWE-1119 Excessive Use of Unconditional Branching (goto)
• CWE-112 Missing XML Validation: Check Documents Against a Schema
• CWE-1120 Excessive Code Complexity: Measure It, Then Reduce It
• CWE-1121 Excessive McCabe Cyclomatic Complexity Explained
• CWE-1122 Excessive Halstead Complexity: What the Metric Means
• CWE-1123 Excessive Use of Self-Modifying Code and Its Risks
• CWE-1124 Excessively Deep Nesting: How to Flatten Your Code
• CWE-1125 Excessive Attack Surface: Count Your Entry Points
• CWE-1126 Variable Declared with Unnecessarily Wide Scope
• CWE-1127 Compilation with Insufficient Warnings or Errors
• CWE-113 HTTP Response Splitting: How It Happens and Fixes
• CWE-114 Process Control: Untrusted Commands and Libraries
• CWE-115 Misinterpretation of Input and Why It Bites
• CWE-116 Improper Output Encoding: The Root of Many Injections
• CWE-1164 Irrelevant Code: Dead Code, Unused Setup and goto fail
• CWE-117 Log Injection: Neutralizing Output Written to Logs
• CWE-1173 Improper Use of Validation Framework: Causes and Fixes
• CWE-1174 ASP.NET Improper Model Validation: A Short Guide
• CWE-1176 Inefficient CPU Computation and Denial of Service
• CWE-1177 Use of Prohibited Code: Banned Functions and Components
• CWE-118 Range Errors: Incorrect Access of Indexable Resources
• CWE-1188 Insecure Default Initialization of a Resource: Fixes
• CWE-1189 Improper Isolation of Shared Resources on a SoC
• CWE-119 Memory Buffer Bounds Errors: How They Happen and How to Fix Them
• CWE-1190 DMA Device Enabled Too Early in the Boot Phase
• CWE-1191 On-Chip Debug and Test Interface Access Control Flaws
• CWE-1192 Improper Identifier for IP Blocks in a SoC
• CWE-1193 Untrusted Core Powered On Before Fabric Access Control
• CWE-12 ASP.NET Missing Custom Error Page: Fix Default Errors
• CWE-120 Classic Buffer Overflow: Copying Input Without a Size Check
• CWE-1204 Weak Initialization Vector (IV): Causes and Fixes
• CWE-1209 Failure to Disable Reserved Bits in Hardware Designs
• CWE-121 Stack-based Buffer Overflow: Causes, Impact and Fixes
• CWE-122 Heap-based Buffer Overflow: How Chains of Small Bugs Cause It
• CWE-1220 Insufficient Granularity of Access Control: A Guide
• CWE-1221 Incorrect Register Defaults or Module Parameters
• CWE-1222 Insufficient Granularity of Register Lock Regions
• CWE-1223 Race Condition for Write-Once Hardware Attributes
• CWE-1224 Improper Restriction of Write-Once Bit Fields
• CWE-1229 Creation of Emergent Resource: Covert Channels Explained
• CWE-123 Write-what-where Condition: When Attackers Pick the Address
• CWE-1230 Exposure of Sensitive Information Through Metadata
• CWE-1231 Improper Prevention of Lock Bit Modification Explained
• CWE-1232 Improper Lock Behavior After Power State Transition
• CWE-1233 Hardware Controls With Missing Lock Bit Protection
• CWE-1234 Hardware Debug Modes That Override Security Locks
• CWE-1235 Autoboxing and Unboxing in Performance Critical Code
• CWE-1236 CSV Injection: Formula Elements in CSV Files, and Fixes
• CWE-1239 Improper Zeroization of Hardware Register: Explained
• CWE-124 Buffer Underwrite: Writing Before the Start of a Buffer
• CWE-1240 Risky Cryptographic Primitive Implementations: Fix Guide
• CWE-1241 Predictable Random Number Generator Algorithms Explained
• CWE-1242 Undocumented Features and Chicken Bits in Devices
• CWE-1243 Fuse Data Exposed During Debug: How It Leaks and Fixes
• CWE-1244 Internal Assets Exposed to Unsafe Debug Access: Fix Guide
• CWE-1245 Improper Finite State Machines in Hardware Logic
• CWE-1246 Improper Write Handling in Limited-Write Memory
• CWE-1247 Protection Against Voltage and Clock Glitches Explained
• CWE-1248 Semiconductor Defects in Security-Sensitive Hardware
• CWE-1249 Admin Tools With an Inconsistent View of the OS
• CWE-125 Out-of-bounds Read: Heartbleed and the Bugs Like It
• CWE-1250 Inconsistent Copies of Shared State in Distributed Systems
• CWE-1251 Mirrored Regions With Different Values: What to Know
• CWE-1252 CPU Not Configured for Write and Execute Exclusivity
• CWE-1253 Incorrect Selection of Fuse Values: Negative Logic Risk
• CWE-1254 Incorrect Comparison Logic Granularity: Timing Attacks
• CWE-1255 Comparison Logic Vulnerable to Power Side-Channel Attacks
• CWE-1256 Software Interfaces to Hardware Features: Plundervolt and More
• CWE-1257 Access Control on Mirrored or Aliased Memory Regions
• CWE-1258 Sensitive Data Left Uncleared When Debug Mode Starts
• CWE-1259 Improper Restriction of Security Token Assignment
• CWE-126 Buffer Over-read: Reading Past the End of a Buffer
• CWE-1260 Overlap Between Protected Memory Ranges: How to Fix
• CWE-1261 Improper Handling of Single Event Upsets in Hardware
• CWE-1262 Improper Access Control for Register Interface Explained
• CWE-1263 Improper Physical Access Control in Product Design
• CWE-1264 Control and Data Channel De-Synchronization in Hardware
• CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code
• CWE-1266 Improper Scrubbing of Decommissioned Device Data
• CWE-1267 Policy Uses Obsolete Encoding: Hardware Access Control
• CWE-1268 Inconsistent Control and Write Policy Privileges
• CWE-1269 Product Released in Non-Release Configuration
• CWE-127 Buffer Under-read: Reading Before the Start of a Buffer
• CWE-1270 Generation of Incorrect Security Tokens in SoCs
• CWE-1271 Uninitialized Security Registers on Reset
• CWE-1272 Sensitive Data Not Cleared at Debug or Power Transitions
• CWE-1273 Device Unlock Credential Sharing Across Companies
• CWE-1274 Weak Access Control on Volatile Memory Holding Boot Code
• CWE-1275 Sensitive Cookie With Improper SameSite Attribute
• CWE-1276 Hardware Child Block Wired Wrongly to Parent
• CWE-1277 Firmware Not Updateable: A Permanent Vulnerability
• CWE-1278 Missing Protection Against IC Imaging Attacks
• CWE-1279 Cryptographic Operations Run Before Inputs Are Ready
• CWE-128 Wrap-around Error: When Counters Roll Past Their Maximum
• CWE-1280 Access Control Check Done After the Asset Is Accessed
• CWE-1281 Instruction Sequences That Hang or Break a Processor
• CWE-1282 Assumed-Immutable Data Stored in Writable Memory
• CWE-1283 Mutable Attestation or Measurement Reporting Data
• CWE-1284 Improper Validation of Specified Quantity in Input
• CWE-1285 Improper Validation of Index, Position, or Offset
• CWE-1286 Improper Validation of Syntactic Correctness of Input
• CWE-1287 Improper Validation of Specified Type of Input
• CWE-1288 Improper Validation of Consistency within Input
• CWE-1289 Unsafe Equivalence in Input: Why Case and Encoding Tricks Work
• CWE-129 Improper Validation of Array Index: Causes and Fixes
• CWE-1290 Incorrect Decoding of Security Identifiers on a Chip
• CWE-1291 Reusing One Public Key for Debug and Production Code
• CWE-1292 Incorrect Conversion of Security Identifiers in SoCs
• CWE-1293 Missing Source Correlation of Multiple Independent Data
• CWE-1294 Insecure Security Identifier Mechanism Explained
• CWE-1295 Debug Messages That Reveal Too Much, and How to Trim Them
• CWE-1296 Incorrect Chaining or Granularity of Debug Components
• CWE-1297 Confidential Device Data Exposed to OSAT Vendors
• CWE-1298 Hardware Logic Contains Race Conditions
• CWE-1299 Missing Protection for an Alternate Hardware Interface
• CWE-13 ASP.NET Password in Configuration File: Fixes That Stick
• CWE-130 Length Parameter Inconsistency: When the Header Lies
• CWE-1300 Improper Protection of Physical Side Channels
• CWE-1301 Incomplete Data Removal Within a Hardware Component
• CWE-1302 Missing Source Identifier in SoC Transactions
• CWE-1303 Non-Transparent Sharing of Microarchitectural Resources
• CWE-1304 Unchecked Hardware Config State on Power Restore
• CWE-131 Incorrect Calculation of Buffer Size: Causes and Fixes
• CWE-1310 Missing Ability to Patch ROM Code in Boot Code
• CWE-1311 Improper Translation of Security Attributes by a Bridge
• CWE-1312 Missing Protection for Mirrored Regions in a Fabric Firewall
• CWE-1313 Hardware That Lets Test or Debug Logic Activate at Runtime
• CWE-1314 Missing Write Protection for Sensor Parametric Data
• CWE-1315 Improper Bus Controlling Capability in a Fabric End-point
• CWE-1316 Fabric Address Map Overlapping Protected and Unprotected Ranges
• CWE-1317 Improper Access Control in a Fabric Bridge
• CWE-1318 On-chip Buses Without Security Features: What to Do
• CWE-1319 Electromagnetic Fault Injection: Causes and Defenses
• CWE-1320 Unprotected Hardware Alert Signals: What Goes Wrong
• CWE-1321 Prototype Pollution: How It Happens and How to Fix It
• CWE-1322 Blocking Code in a Single-Threaded, Non-Blocking Context
• CWE-1323 Sensitive Trace Data on SoCs: Risk and Fixes
• CWE-1325 Improperly Controlled Sequential Memory Allocation
• CWE-1326 Missing Immutable Root of Trust in Hardware
• CWE-1327 Binding to 0.0.0.0: The Unrestricted IP Address Risk
• CWE-1328 Mutable Security Version Numbers and Rollback Attacks
• CWE-1329 Reliance on a Component That Cannot Be Updated
• CWE-1330 Remanent Data Readable After a Memory Erase
• CWE-1331 Network on Chip Isolation Failures and Timing Channels
• CWE-1332 Instruction Skip Faults: How One Skipped Branch Breaks Security
• CWE-1333 Inefficient Regular Expression Complexity (ReDoS)
• CWE-1334 Error Injection That Degrades Hardware Redundancy
• CWE-1335 Incorrect Bitwise Shift of Integer: Overshift Bugs
• CWE-1336 Template Engine Injection (SSTI): Causes and Fixes
• CWE-1338 Missing Protection Against Hardware Overheating
• CWE-1339 Insufficient Precision or Accuracy of a Real Number
• CWE-134 Externally-Controlled Format String: Risks and Fixes
• CWE-1341 Multiple Releases of the Same Resource or Handle
• CWE-1342 Microarchitectural State Exposure After Transient Execution
• CWE-135 Incorrect Calculation of Multi-Byte String Length
• CWE-1351 Hardware Behavior in Exceptionally Cold Environments
• CWE-1357 Reliance on an Insufficiently Trustworthy Component
• CWE-138 Improper Neutralization of Special Elements Explained
• CWE-1384 Improper Handling of Physical or Environmental Conditions
• CWE-1385 Missing Origin Validation in WebSockets (CSWSH)
• CWE-1386 Windows Junction and Mount Point Abuse: Cause and Fix
• CWE-1389 Incorrect Parsing of Numbers with Different Radices
• CWE-1390 Weak Authentication: Proving Identity Is Not Enough
• CWE-1391 Use of Weak Credentials: Four Ways Secrets Go Bad
• CWE-1392 Use of Default Credentials: Why Defaults Get Exploited
• CWE-1393 Use of Default Password: Fix It Before It Ships
• CWE-1394 Use of Default Cryptographic Key: Shared Keys, Shared Risk
• CWE-1395 Dependency on a Vulnerable Third-Party Component
• CWE-14 Compiler Removal of Code to Clear Buffers: Dead Store Trap
• CWE-140 Improper Neutralization of Delimiters: Causes and Fixes
• CWE-141 Improper Neutralization of Parameter/Argument Delimiters
• CWE-1419 Incorrect Initialization of Resource: Defaults That Bite
• CWE-142 Improper Neutralization of Value Delimiters Explained
• CWE-1420 Sensitive Information Exposure in Transient Execution
• CWE-1421 Data Leaks in Shared Microarchitectural Structures
• CWE-1422 Incorrect Data Forwarding During Transient Execution
• CWE-1423 Shared Predictor State and Transient Execution Leaks
• CWE-1426 Improper Validation of Generative AI Output
• CWE-1427 Prompt Injection: Neutralizing Input Used for LLM Prompts
• CWE-1428 Reliance on HTTP Instead of HTTPS: What to Change
• CWE-1429 Missing Feedback for Unexecuted Hardware Operations
• CWE-143 Improper Neutralization of Record Delimiters
• CWE-1431 Intermediate Crypto State Driven to Hardware Outputs
• CWE-1434 Insecure Settings for Generative AI Inference Parameters
• CWE-144 Improper Neutralization of Line Delimiters
• CWE-145 Improper Neutralization of Section Delimiters
• CWE-146 Improper Neutralization of Expression/Command Delimiters
• CWE-147 Improper Neutralization of Input Terminators
• CWE-148 Improper Neutralization of Input Leaders Explained
• CWE-149 Improper Neutralization of Quoting Syntax: Fix Guide
• CWE-15 External Control of System or Configuration Setting
• CWE-150 Escape and Control Sequence Neutralization Failures
• CWE-151 Comment Delimiter Neutralization: How It Breaks Parsers
• CWE-152 Macro Symbol Neutralization: Risks and Fixes
• CWE-153 Substitution Characters: Neutralization Failures
• CWE-154 Variable Name Delimiters: How to Stop Expansion Attacks
• CWE-155 Wildcard and Matching Symbol Neutralization Failures
• CWE-156 Whitespace Neutralization: When Spaces Change Meaning
• CWE-157 Paired Delimiters: Unbalanced Quotes and Brackets
• CWE-158 Null Byte Injection: How It Works and How to Stop It
• CWE-159 Invalid Use of Special Elements: Class Overview
• CWE-160 Leading Special Elements: Absolute Paths and Prefixes
• CWE-161 Multiple Leading Special Elements: Repeated Slashes
• CWE-162 Trailing Special Elements: Slashes, Dots and Spaces
• CWE-163 Multiple Trailing Special Elements: Directory Listings
• CWE-164 Internal Special Elements: Neutralization Failures
• CWE-165 Multiple Internal Special Elements: What to Check
• CWE-166 Missing Special Element: Crashes and Hangs From Short Input
• CWE-167 Additional Special Element: Extra Characters That Beat Filters
• CWE-168 Inconsistent Special Elements: Misordered and Unnested Input
• CWE-170 Improper Null Termination in C and C++: Causes and Fixes
• CWE-172 Encoding Error: Decoding Bugs That Bypass Security Checks
• CWE-173 Improper Handling of Alternate Encoding: A Practical Guide
• CWE-174 Double Decoding of the Same Data: How It Bypasses Filters
• CWE-175 Improper Handling of Mixed Encoding: Short Guide
• CWE-176 Improper Handling of Unicode Encoding: Causes and Fixes
• CWE-177 Improper Handling of URL Encoding: How to Fix It
• CWE-178 Improper Handling of Case Sensitivity: Risks and Fixes
• CWE-179 Early Validation: Why Order of Operations Matters
• CWE-180 Validate Before Canonicalize: The Order That Breaks Checks
• CWE-181 Validate Before Filter: How Filtering Recreates Attacks
• CWE-182 Collapse of Data into Unsafe Value: Causes and Defenses
• CWE-183 Permissive List of Allowed Inputs: When Allowlists Leak
• CWE-184 Incomplete List of Disallowed Inputs: Why Denylists Fail
• CWE-185 Incorrect Regular Expression: Anchors, Nulls and Bypasses
• CWE-186 Overly Restrictive Regular Expression: Missed Matches
• CWE-187 Partial String Comparison: How Prefix Matches Go Wrong
• CWE-188 Reliance on Data/Memory Layout: Why Assumptions Break
• CWE-190 Integer Overflow or Wraparound: How It Happens and How to Fix It
• CWE-191 Integer Underflow (Wrap or Wraparound): Causes and Fixes
• CWE-192 Integer Coercion Error: Casts That Change Values
• CWE-193 Off-by-one Error: Small Mistake, Large Consequences
• CWE-194 Unexpected Sign Extension: When Negative Numbers Grow
• CWE-195 Signed to Unsigned Conversion Error: Negative Becomes Huge
• CWE-196 Unsigned to Signed Conversion Error: Underwrite Risk
• CWE-197 Numeric Truncation Error: Lost Bits, Lost Safety
• CWE-198 Use of Incorrect Byte Ordering: Endianness Bugs
• CWE-20 Improper Input Validation: Where It Starts and How to Fix It
• CWE-200 Exposure of Sensitive Information: Causes and Fixes
• CWE-201 Insertion of Sensitive Information Into Sent Data
• CWE-202 Exposure of Sensitive Information Through Data Queries
• CWE-203 Observable Discrepancy: How It Happens and How to Fix It
• CWE-204 Observable Response Discrepancy: Stop User Enumeration
• CWE-205 Observable Behavioral Discrepancy Explained
• CWE-206: Internal Behavior Leaks in Login and Multi-Step Checks
• CWE-207: When Behavior Fingerprints Your Product
• CWE-208 Observable Timing Discrepancy: Constant-Time Comparison
• CWE-209 Error Messages With Sensitive Information: Fix Guide
• CWE-210 Self-Generated Error Messages With Sensitive Data
• CWE-211 Externally-Generated Error Messages: Path Disclosure
• CWE-212: Removing Sensitive Data Before You Share a File
• CWE-213: Sensitive Data Exposed by Incompatible Policies
• CWE-214 Secrets on the Command Line: Visible in ps
• CWE-215 Sensitive Information in Debugging Code
• CWE-219 Sensitive Files Under the Web Root: Find and Fix
• CWE-22 Path Traversal: How It Happens and How to Fix It
• CWE-220: Sensitive Files Left Under the FTP Root
• CWE-221 Information Loss or Omission in Security Records
• CWE-222 Truncation of Security-Relevant Information
• CWE-223 Omission of Security-Relevant Information in Logs
• CWE-224: Logging Under an Alternate Name Hides the Target
• CWE-226: Clear Memory and Files Before Reuse
• CWE-228 Improper Handling of Syntactically Invalid Structure
• CWE-229 Improper Handling of Values: Missing and Extra Input
• CWE-23 Relative Path Traversal: Dot-Dot Sequences and Safe Fixes
• CWE-230 Improper Handling of Missing Values: Blank Parameters
• CWE-231 Improper Handling of Extra Values in Input
• CWE-232 Improper Handling of Undefined Values
• CWE-233 Improper Handling of Parameters: Missing and Undefined Input
• CWE-234 Failure to Handle Missing Parameter: Crashes and Code Execution
• CWE-235 Extra Parameters: When Duplicate Fields Bypass Your Checks
• CWE-236 Undefined Parameters: Handling Input You Never Defined
• CWE-237 Improper Handling of Structural Elements in Complex Input
• CWE-238 Incomplete Structural Elements: Half-Formed Input
• CWE-239 Failure to Handle Incomplete Element: Hangs from Partial Requests
• CWE-24 Path Traversal with '../filedir': The Canonical Escape
• CWE-240 Inconsistent Structural Elements: The Root of Heartbleed
• CWE-241 Unexpected Data Type: When a Letter Shows Up Where a Digit Belongs
• CWE-242 Use of Inherently Dangerous Function: gets() and Friends
• CWE-243 chroot Jail Without Changing Working Directory
• CWE-244 Heap Inspection: Clearing Secrets Before realloc and free
• CWE-245 J2EE Bad Practices: Managing Connections Yourself
• CWE-246 J2EE Bad Practices: Opening Sockets Directly
• CWE-248 Uncaught Exception: Crashes and Leaks from Unhandled Errors
• CWE-25 Path Traversal with '/../filedir': Bypass and Fix
• CWE-250 Execution with Unnecessary Privileges: Least Privilege in Practice
• CWE-252 Unchecked Return Value: The Failure You Never Noticed
• CWE-253 Incorrect Check of Function Return Value: Checking the Wrong Thing
• CWE-256 Plaintext Storage of a Password: Why It Still Happens
• CWE-257 Storing Passwords in a Recoverable Format
• CWE-258 Empty Password in Configuration File
• CWE-259 Use of Hard-coded Password: Inbound, Outbound and the Fix
• CWE-26 Path Traversal with '/dir/../filename': How Filters Fail
• CWE-260 Password in Configuration File: Moving Secrets Out of Config
• CWE-261 Weak Encoding for Password: Base64 Is Not Protection
• CWE-262 Not Using Password Aging: Rotation, Compliance and Trade-offs
• CWE-263 Password Aging With Long Expiration: What to Do Instead
• CWE-266 Incorrect Privilege Assignment: How It Happens and Fixes
• CWE-267 Privilege Defined With Unsafe Actions: Dangerous Roles
• CWE-268 Privilege Chaining: When Two Safe Rights Add Up to Admin
• CWE-269 Improper Privilege Management: Causes, Examples, Fixes
• CWE-27 Path Traversal with 'dir/../../filename': Multiple Hops
• CWE-270 Privilege Context Switching Error: Handing Off Safely
• CWE-271 Privilege Dropping and Lowering Errors: A Practical Guide
• CWE-272 Least Privilege Violation: Drop Rights After chroot
• CWE-273 Improper Check for Dropped Privileges: Verify setuid
• CWE-274 Improper Handling of Insufficient Privileges Explained
• CWE-276 Incorrect Default Permissions: Find and Fix Them
• CWE-277 Insecure Inherited Permissions: Umask and Temp Files
• CWE-278 Insecure Preserved Inherited Permissions in Archives
• CWE-279 Incorrect Execution-Assigned Permissions and Log Files
• CWE-28 Path Traversal with '..\filedir' on Windows Systems
• CWE-280 Improper Handling of Insufficient Permissions or Privileges
• CWE-281 Improper Preservation of Permissions in Copies and Backups
• CWE-282 Improper Ownership Management: Wrong Owner, Wrong Trust
• CWE-283 Unverified Ownership: Check Who Owns the Resource
• CWE-284 Improper Access Control: The Pillar Behind Many Breaches
• CWE-285 Improper Authorization: Missing Checks and How to Fix
• CWE-286 Incorrect User Management: Wrong Group, Wrong Access
• CWE-287 Improper Authentication: How Logins Fail and Fixes
• CWE-288 Authentication Bypass Using an Alternate Path or Channel
• CWE-289 Authentication Bypass by Alternate Name Explained
• CWE-29 Path Traversal with '\..\filename' on Windows
• CWE-290 Authentication Bypass by Spoofing: IP and Header Trust
• CWE-291 Reliance on IP Address for Authentication: Fix Guide
• CWE-293 Using the Referer Header for Authentication
• CWE-294 Capture-Replay Authentication Bypass Explained
• CWE-295 Improper Certificate Validation: How to Fix It
• CWE-296 Improper Following of a Certificate Chain of Trust
• CWE-297 Certificate Host Mismatch: Check the Name Too
• CWE-298 Improper Validation of Certificate Expiration
• CWE-299 Improper Check for Certificate Revocation
• CWE-30 Path Traversal with '\dir\..\filename' Explained
• CWE-300 Channel Accessible by Non-Endpoint: Man in the Middle
• CWE-301 Reflection Attacks in Authentication Protocols
• CWE-302 Authentication Bypass by Assumed-Immutable Data
• CWE-303 Incorrect Implementation of an Authentication Algorithm
• CWE-304 Missing Critical Step in Authentication
• CWE-305 Authentication Bypass by Primary Weakness
• CWE-306 Missing Authentication for Critical Function: A Fix Guide
• CWE-307 Excessive Authentication Attempts: Stop Brute Force
• CWE-308 Use of Single-Factor Authentication: Why One Factor Fails
• CWE-309 Use of Password System for Primary Authentication
• CWE-31 Path Traversal with 'dir\..\..\filename' Explained
• CWE-311 Missing Encryption of Sensitive Data: Practical Fixes
• CWE-312 Cleartext Storage of Sensitive Information: Fix Guide
• CWE-313 Cleartext Storage in a File or on Disk
• CWE-314 Cleartext Storage in the Windows Registry
• CWE-315 Cleartext Storage of Sensitive Information in a Cookie
• CWE-316 Cleartext Storage of Sensitive Information in Memory
• CWE-317 Cleartext Storage of Sensitive Information in a GUI
• CWE-318 Cleartext Secrets in Executables: Why Binaries Are Not Vaults
• CWE-319 Cleartext Transmission of Sensitive Information: Fix Guide
• CWE-32 Path Traversal with the Triple Dot '...' Sequence
• CWE-321 Hard-coded Cryptographic Keys: How to Find and Remove Them
• CWE-322 Key Exchange Without Entity Authentication Explained
• CWE-323 Reusing a Nonce, Key Pair in Encryption: What Goes Wrong
• CWE-324 Using a Key Past Its Expiration Date: Risk and Fixes
• CWE-325 Missing Cryptographic Step: Encryption Weaker Than Advertised
• CWE-326 Inadequate Encryption Strength: When Good Crypto Is Too Weak
• CWE-327 Broken or Risky Cryptographic Algorithms: A Practical Guide
• CWE-328 Use of Weak Hash: Why MD5 and SHA-1 Fail and What to Use
• CWE-329 Predictable IV with CBC Mode: How It Breaks and How to Fix It
• CWE-33 Path Traversal with '....' (Multiple Dot) and How to Stop It
• CWE-330 Insufficiently Random Values: Tokens Attackers Can Guess
• CWE-331 Insufficient Entropy: Random Values With Patterns
• CWE-332 Insufficient Entropy in a PRNG: Stability and Security Risks
• CWE-333 Improper Handling of Insufficient Entropy in a TRNG
• CWE-334 Small Space of Random Values: Easy to Brute Force
• CWE-335 Incorrect Usage of Seeds in a PRNG: Seeding Done Wrong
• CWE-336 Same Seed in a PRNG: Identical Output Every Run
• CWE-337 Predictable Seed in a PRNG: Time and Process ID Are Not Secrets
• CWE-338 Cryptographically Weak PRNG: Use a CSPRNG for Secrets
• CWE-339 Small Seed Space in a PRNG: Brute-Forcing the Seed
• CWE-34 Path Traversal with '....//' and Sequential Filter Collapse
• CWE-340 Predictable Numbers or Identifiers: Guessable by Design
• CWE-341 Predictable from Observable State: Values Built From Time and PID
• CWE-342 Predictable Exact Value from Previous Values
• CWE-343 Predictable Value Range from Previous Values
• CWE-344 Invariant Value in a Changing Context: Why It Bites
• CWE-345 Insufficient Verification of Data Authenticity
• CWE-346 Origin Validation Error: Check Who Is Talking
• CWE-347 Improper Verification of Cryptographic Signature
• CWE-348 Use of Less Trusted Source: Pick the Source You Can Verify
• CWE-349 Untrusted Data Riding Along With Trusted Data
• CWE-35 Path Traversal with '.../...//' and Filter Collapse
• CWE-350 Reliance on Reverse DNS for Security Decisions
• CWE-351 Insufficient Type Distinction: Confusing Two Things
• CWE-352 Cross-Site Request Forgery: How It Works and How to Fix It
• CWE-353 Missing Support for Integrity Check in Protocols
• CWE-354 Improper Validation of Integrity Check Value
• CWE-356 UI Does Not Warn of Unsafe Actions: What to Build In
• CWE-357 Insufficient UI Warning of Dangerous Operations
• CWE-358 Improperly Implemented Security Check for Standard
• CWE-359 Exposure of Private Personal Information to Unauthorized Actors
• CWE-36 Absolute Path Traversal: How It Happens and How to Fix It
• CWE-360 Trust of System Event Data: Events Can Be Spoofed
• CWE-362 Race Condition: Concurrent Execution With Shared Resources
• CWE-363 Race Condition Enabling Link Following
• CWE-364 Signal Handler Race Condition in C and C++
• CWE-366 Race Condition Within a Thread: Shared State Hazards
• CWE-367 TOCTOU Race Condition: Check Then Use Fails
• CWE-368 Context Switching Race Condition in Browsers and More
• CWE-369 Divide by Zero: Small Bug, Real Denial of Service
• CWE-37 Slash Absolute Path Traversal: Causes and Fixes
• CWE-370 Missing Certificate Revocation Check After the First
• CWE-372 Incomplete Internal State Distinction Explained
• CWE-374 Passing Mutable Objects to an Untrusted Method: Fix Guide
• CWE-375 Returning a Mutable Object to an Untrusted Caller
• CWE-377 Insecure Temporary File: How It Happens and How to Fix It
• CWE-378 Temporary File With Insecure Permissions: Causes and Fixes
• CWE-379 Temporary File in a Directory With Insecure Permissions
• CWE-38 Backslash Absolute Path Traversal Explained
• CWE-382 J2EE Bad Practices: Use of System.exit() in a Web App
• CWE-383 J2EE Bad Practices: Direct Use of Threads in Web Apps
• CWE-384 Session Fixation: How It Happens and How to Fix It
• CWE-385 Covert Timing Channel: When Timing Leaks Secrets
• CWE-386 Symbolic Name Not Mapping to the Correct Object
• CWE-39 Drive Letter Path Traversal: Why C:dirname Matters
• CWE-390 Detection of Error Condition Without Action: Fix Guide
• CWE-391 Unchecked Error Condition: Deprecated, Still Useful
• CWE-392 Missing Report of Error Condition: Causes and Fixes
• CWE-393 Return of Wrong Status Code: How It Breaks Security Logic
• CWE-394 Unexpected Status Code or Return Value: Causes and Fixes
• CWE-395 Catching NullPointerException Instead of Checking for Null
• CWE-396 Declaration of Catch for Generic Exception: Fix Guide
• CWE-397 Declaration of Throws for Generic Exception
• CWE-40 Windows UNC Share Path Traversal in Plain Terms
• CWE-400 Uncontrolled Resource Consumption: Causes and Fixes
• CWE-401 Missing Release of Memory After Effective Lifetime
• CWE-402 Resource Leak: Private Resources Moved Into a New Sphere
• CWE-403 File Descriptor Leak to a Child Process: Fix Guide
• CWE-404 Improper Resource Shutdown or Release: Causes and Fixes
• CWE-405 Asymmetric Resource Consumption (Amplification) Explained
• CWE-406 Insufficient Control of Network Message Volume
• CWE-407 Inefficient Algorithmic Complexity: Causes and Fixes
• CWE-408 Early Amplification: Expensive Work Before Auth
• CWE-409 Decompression Bombs: Handling Highly Compressed Data
• CWE-41 Improper Resolution of Path Equivalence, Explained
• CWE-410 Insufficient Resource Pool: When Pools Run Dry
• CWE-412 Unrestricted Externally Accessible Lock Explained
• CWE-413 Improper Resource Locking: Risks and Fixes
• CWE-414 Missing Lock Check: Sensitive Work Without a Check
• CWE-415 Double Free: How It Happens and How to Fix It
• CWE-416 Use After Free: How It Happens and How to Fix It
• CWE-419 Unprotected Primary Channel in Plain Terms
• CWE-42 Trailing Dot Path Equivalence: Source Disclosure Bug
• CWE-420 Unprotected Alternate Channel: The Side Door Problem
• CWE-421 Race Condition During Access to Alternate Channel
• CWE-422 Unprotected Windows Messaging Channel (Shatter)
• CWE-424 Improper Protection of Alternate Path
• CWE-425 Forced Browsing: Direct Requests to Restricted URLs
• CWE-426 Untrusted Search Path: Causes, Examples and Fixes
• CWE-427 Uncontrolled Search Path Element: How to Avoid It
• CWE-428 Unquoted Search Path: The Program Files Trap
• CWE-43 Multiple Trailing Dot Path Equivalence
• CWE-430 Deployment of Wrong Handler: Causes and Fixes
• CWE-431 Missing Handler: Unhandled Failures and Crashes
• CWE-432 Dangerous Signal Handler Not Disabled
• CWE-433 Unparsed Raw Web Content Delivery Explained
• CWE-434 Unrestricted File Upload: How It Happens and How to Fix It
• CWE-435 Improper Interaction Between Correct Components
• CWE-436 Interpretation Conflict: When Systems Disagree
• CWE-437 Incomplete Model of Endpoint Features: Explained
• CWE-439 Behavioral Change in New Version or Environment
• CWE-44 Internal Dot Path Equivalence and CVE-2025-24813
• CWE-440 Expected Behavior Violation: When Code Ignores Its Spec
• CWE-441 Confused Deputy: Unintended Proxy and How to Stop It
• CWE-444 HTTP Request Smuggling: How It Happens and How to Fix It
• CWE-446 UI Discrepancy for Security Feature
• CWE-447 Unimplemented or Unsupported Feature in UI
• CWE-448 Obsolete Feature in UI: Warn Before Users Rely on It
• CWE-449 The UI Performs the Wrong Action
• CWE-45 Multiple Internal Dot Path Equivalence
• CWE-450 Multiple Interpretations of UI Input
• CWE-451 UI Misrepresentation of Critical Information
• CWE-453 Insecure Default Variable Initialization Explained
• CWE-454 External Initialization of Trusted Variables or Data Stores
• CWE-455 Non-exit on Failed Initialization: Fail Securely
• CWE-456 Missing Initialization of a Variable: Causes and Fixes
• CWE-457 Use of Uninitialized Variable: How to Find and Fix It
• CWE-459 Incomplete Cleanup: Temp Files and Leftover Resources
• CWE-46 Trailing Space Path Equivalence and %20 Bypasses
• CWE-460 Improper Cleanup on Thrown Exception
• CWE-462 Duplicate Key in Associative List (Alist)
• CWE-463 Deletion of Data Structure Sentinel
• CWE-464 Addition of Data Structure Sentinel
• CWE-466 Return of Pointer Value Outside of Expected Range
• CWE-467 Use of sizeof() on a Pointer Type: Bug and Fix
• CWE-468 Incorrect Pointer Scaling in C and C++
• CWE-469 Use of Pointer Subtraction to Determine Size
• CWE-47 Leading Space Path Equivalence Explained
• CWE-470 Unsafe Reflection: How It Happens and How to Fix It
• CWE-471 Assumed-Immutable Data: Why Client Values Can't Be Trusted
• CWE-472 Hidden Form Fields and Cookies: Web Parameter Tampering
• CWE-473 PHP External Variable Modification Explained
• CWE-474 Functions with Inconsistent Implementations
• CWE-475 Undefined Behavior for Input to an API
• CWE-476 NULL Pointer Dereference: Causes, Detection and Fixes
• CWE-477 Use of Obsolete Functions: Why Deprecated Calls Matter
• CWE-478 Missing Default Case in a Switch Statement
• CWE-479 Non-Reentrant Functions in Signal Handlers
• CWE-48 Internal Whitespace Path Equivalence and Quoting Bugs
• CWE-480 Use of Incorrect Operator: Small Typos, Big Auth Bugs
• CWE-481 Assigning Instead of Comparing in Conditions
• CWE-482 Comparing Instead of Assigning in C and C++
• CWE-483 Incorrect Block Delimitation and the goto fail Bug
• CWE-484 Omitted Break Statement in Switch: Accidental Fallthrough
• CWE-486 Comparison of Classes by Name in Java
• CWE-487 Reliance on Package-level Scope in Java
• CWE-488 Data Exposed to the Wrong Session: Servlet Fields
• CWE-489 Active Debug Code: Shipping Backdoors by Accident
• CWE-49 Trailing Slash Path Equivalence: Auth Bypass Cases
• CWE-491 Public cloneable() Without Final: Java Object Hijack
• CWE-492 Inner Classes Containing Sensitive Data in Java
• CWE-493 Critical Public Variable Without Final Modifier
• CWE-494 Download of Code Without Integrity Check: Fixes
• CWE-495 Private Data Structure Returned From a Public Method
• CWE-496 Public Data Assigned to a Private Array-Typed Field
• CWE-497 Exposure of Sensitive System Information: Find and Fix
• CWE-498 Cloneable Class With Sensitive Data: Cause and Fix
• CWE-499 Serializable Class Containing Sensitive Data in Java
• CWE-5 J2EE Data Transmission Without Encryption: Causes and Fixes
• CWE-50 Multiple Leading Slash Path Equivalence: Causes and Fixes
• CWE-500 Public Static Field Not Marked Final: Risk and Fix
• CWE-501 Trust Boundary Violation: Mixing Trusted and Untrusted Data
• CWE-502 Deserialization of Untrusted Data: Causes and Fixes
• CWE-506 Embedded Malicious Code: Detecting Backdoors in Software
• CWE-507 Trojan Horse in Software: What It Is and How to Defend
• CWE-508 Non-Replicating Malicious Code: Meaning and Defense
• CWE-509 Replicating Malicious Code: Viruses, Worms and Your Supply Chain
• CWE-51 Multiple Internal Slash Path Equivalence
• CWE-510 Trapdoor: Hidden Code That Skips Authentication
• CWE-511 Logic and Time Bombs: Code That Waits to Strike
• CWE-512 Spyware: Software That Collects What Users Did Not Allow
• CWE-514 Covert Channel: Hidden Paths for Moving Data
• CWE-515 Covert Storage Channel: Data Hidden in Bits and Names
• CWE-52 Multiple Trailing Slash Path Equivalence
• CWE-520 .NET Impersonation: When the App Runs With User Rights
• CWE-521 Weak Password Requirements: Build a Policy That Works
• CWE-522 Insufficiently Protected Credentials: Causes and Fixes
• CWE-523 Unprotected Transport of Credentials on Login Pages
• CWE-524 Cache Containing Sensitive Information: How to Prevent It
• CWE-525 Browser Cache Containing Sensitive Information
• CWE-526 Cleartext Secrets in Environment Variables: Risks and Fixes
• CWE-527 Exposed Version Control Repository on a Web Server
• CWE-528 Exposed Core Dump Files: Memory Left Where Others Can Read
• CWE-529 Exposed Access Control List Files: Risk and Fix
• CWE-53 Multiple Internal Backslash Path Equivalence
• CWE-530 Exposed Backup Files: How It Happens and How to Fix It
• CWE-531 Sensitive Information in Test Code: Risks and Fixes
• CWE-532 Sensitive Information in Log Files: Find It and Fix It
• CWE-535 Shell Error Message Exposure: What It Reveals
• CWE-536 Servlet Runtime Error Messages: Stop Leaking Stack Traces
• CWE-537 Java Runtime Error Messages: Keep Exceptions Off the Screen
• CWE-538 Sensitive Data in Externally Accessible Files
• CWE-539 Persistent Cookies With Sensitive Data: Risks and Fixes
• CWE-54 Trailing Backslash Path Equivalence and ASP.NET Bypass
• CWE-540 Sensitive Information in Source Code: Real Cases and Fixes
• CWE-541 Sensitive Information in Include Files: What to Know
• CWE-543 Singleton Without Synchronization: Thread Safety Bugs
• CWE-544 Missing Standardized Error Handling: Why Consistency Matters
• CWE-546 Suspicious Comments: What FIXME and HACK Are Telling You
• CWE-547 Hard-coded Security Constants: Maintenance Traps
• CWE-548 Directory Listing Exposure: How to Find and Turn It Off
• CWE-549 Missing Password Field Masking: A Small Bug With Real Cost
• CWE-55 Single Dot Directory Path Equivalence and CVE-2024-6091
• CWE-550 Server Error Messages That Leak: Handling Errors Safely
• CWE-551 Authorization Before URL Canonicalization: Bypass Explained
• CWE-552 Files or Directories Accessible to External Parties
• CWE-553 Command Shell in an Accessible Directory
• CWE-554 ASP.NET Without an Input Validation Framework
• CWE-555 J2EE Plaintext Password in Configuration Files
• CWE-556 ASP.NET Identity Impersonation: Least Privilege Gone Wrong
• CWE-558 Use of getlogin() in Multithreaded Applications
• CWE-56 Wildcard Path Equivalence: When * Lists Your Files
• CWE-560 umask() With a chmod-style Argument
• CWE-561 Dead Code: How It Happens and How to Fix It
• CWE-562 Return of Stack Variable Address: Cause and Fix
• CWE-563 Assignment to Variable Without Use: Dead Stores
• CWE-564 SQL Injection in Hibernate: Cause and Fix
• CWE-565 Reliance on Cookies Without Validation: Fix Guide
• CWE-566 User-Controlled SQL Primary Key: Cause and Fix
• CWE-567 Unsynchronized Shared Data: Cause and Fix in Java
• CWE-568 finalize() Without super.finalize() in Java
• CWE-57 Path Equivalence: fakedir/../realdir/filename Bypass
• CWE-570 Expression Is Always False: Causes and Fixes
• CWE-571 Expression Is Always True: Causes and Fixes
• CWE-572 Call to Thread run() Instead of start() in Java
• CWE-573 Improper Following of Specification by Caller
• CWE-574 EJB Use of Synchronization Primitives
• CWE-575 EJB Use of AWT and Swing: Why Beans Must Not
• CWE-576 EJB Use of Java I/O: File Access in Beans
• CWE-577 EJB Use of Sockets: Beans Must Not Listen
• CWE-578 EJB Use of Class Loader: Why Beans Must Not
• CWE-579 Non-serializable Object Stored in Session (J2EE)
• CWE-58 Windows 8.3 Filename Path Equivalence Explained
• CWE-580 clone() Without super.clone(): Java Cloning Bug
• CWE-581 Equals Without hashCode: Java Object Model Bug
• CWE-582 Public Final Static Array in Java: Why final Fails
• CWE-583 Public finalize() Method in Java: Risk and Fix
• CWE-584 Return Inside Finally Block: Swallowed Exceptions
• CWE-585 Empty Synchronized Block in Java: Why It Is a Smell
• CWE-586 Explicit Call to finalize() in Java: Why Not
• CWE-587 Fixed Address Pointer: Why Hardcoded Addresses Bite
• CWE-588: Accessing a Field Through a Non-Structure Pointer Cast
• CWE-589: Calling an API That Is Missing on Some Platforms
• CWE-59 Link Following: How Symlink and Shortcut Attacks Work
• CWE-590 Free of Memory Not on the Heap: Causes and Fixes
• CWE-591: Sensitive Data in Improperly Locked Memory
• CWE-593: OpenSSL CTX Changed After SSL Objects Exist
• CWE-594: J2EE Sessions Holding Unserializable Objects
• CWE-595: Comparing Object References Instead of Contents
• CWE-597: Wrong Operator in a String Comparison
• CWE-598 Sensitive Query Strings: Why Secrets Don't Belong in URLs
• CWE-599: Missing Validation of an OpenSSL Certificate
• CWE-6 J2EE Insufficient Session ID Length: Risk and Fix
• CWE-600: Uncaught Exceptions in a Java Servlet
• CWE-601 Open Redirect: How It Happens and How to Fix It
• CWE-602: Client-Side Enforcement of Server-Side Security
• CWE-603 Client-Side Authentication: Why the Server Must Decide
• CWE-605: Multiple Binds to the Same Port and Stolen Traffic
• CWE-606: Unchecked Input Used as a Loop Condition
• CWE-607: Public Static Final Field Holding a Mutable Object
• CWE-608: Struts ActionForm Fields That Are Not Private
• CWE-609 Double-Checked Locking: Why the Classic Pattern Fails
• CWE-61 UNIX Symbolic Link Following: Causes, Checks, Fixes
• CWE-610: Externally Controlled Reference to Another Sphere
• CWE-611 XXE: How XML External Entities Leak Files and Fix
• CWE-612: Improper Authorization of an Index With Sensitive Data
• CWE-613 Insufficient Session Expiration: Tokens That Never Die
• CWE-614 Cookie Without the Secure Attribute: Fix Guide
• CWE-615 Sensitive Information in Source Comments: Find and Fix
• CWE-616 PHP Upload Variables Overwritten: Cause and Fix
• CWE-617 Reachable Assertion: When assert() Becomes a DoS
• CWE-618 Exposed Unsafe ActiveX Method: Risk and Fix
• CWE-619 Dangling Database Cursor: How It Leaks Access
• CWE-62 UNIX Hard Link: How It Happens and How to Fix It
• CWE-620 Unverified Password Change: How to Close the Gap
• CWE-621 Variable Extraction Error in PHP: Cause and Fix
• CWE-622 Function Hook Arguments Not Validated: A Guide
• CWE-623 ActiveX Marked Safe For Scripting: Why It Hurts
• CWE-624 Executable Regular Expression Error in PHP and Perl
• CWE-625 Permissive Regular Expression: Anchor Your Patterns
• CWE-626 Poison Null Byte: How a NUL Breaks Your Checks
• CWE-627 Dynamic Variable Evaluation: Risks and Fixes
• CWE-628 Function Call With Incorrect Arguments Explained
• CWE-636 Not Failing Securely: Why Fail-Open Designs Hurt
• CWE-637 Unnecessary Complexity in Protection Mechanisms
• CWE-638 Not Using Complete Mediation: Check Every Access
• CWE-639 Authorization Bypass Through User-Controlled Key (IDOR)
• CWE-64 Windows Shortcut Following (.LNK): Risk and Fix
• CWE-640 Weak Password Recovery for Forgotten Password
• CWE-641 Improper Restriction of File and Resource Names
• CWE-642 External Control of Critical State Data: Fix Guide
• CWE-643 XPath Injection: How It Works and How to Fix It
• CWE-644 Scripting Syntax in HTTP Headers: Risk and Fix
• CWE-645 Overly Restrictive Account Lockout: Fix Guide
• CWE-646 Reliance on File Name or Extension of Uploaded Files
• CWE-647 Non-Canonical URL Paths in Authorization Decisions
• CWE-648 Incorrect Use of Privileged APIs and How to Avoid It
• CWE-649 Obfuscated or Encrypted Inputs Without Integrity Checks
• CWE-65 Windows Hard Link: What It Is and How to Prevent It
• CWE-650 Trusting HTTP Methods for Access Control
• CWE-651 Exposed WSDL Files and the Information They Leak
• CWE-652 XQuery Injection: How It Works and How to Prevent It
• CWE-653 Improper Isolation or Compartmentalization
• CWE-654 Reliance on a Single Factor in a Security Decision
• CWE-655 Insufficient Psychological Acceptability
• CWE-656 Reliance on Security Through Obscurity
• CWE-657 Violation of Secure Design Principles
• CWE-66 Virtual Resource File Names: How It Happens and Fixes
• CWE-662 Improper Synchronization in Concurrent Code
• CWE-663 Non-Reentrant Functions in Concurrent Code and Signals
• CWE-664 Improper Control of a Resource Through Its Lifetime
• CWE-665 Improper Initialization: Causes, Risks and Fixes
• CWE-666 Operation on a Resource in the Wrong Lifetime Phase
• CWE-667 Improper Locking: Deadlocks, Double Unlocks and Races
• CWE-668 Exposure of a Resource to the Wrong Sphere
• CWE-669 Incorrect Resource Transfer Between Spheres
• CWE-67 Windows Device Names (AUX, CON): Risk and Fix
• CWE-670 Always-Incorrect Control Flow Implementation
• CWE-671 Lack of Administrator Control over Security
• CWE-672 Operation on a Resource After Expiration or Release
• CWE-673 External Influence of Sphere Definition
• CWE-674 Uncontrolled Recursion: Stack Exhaustion and How to Stop It
• CWE-675 Multiple Operations on a Resource in a Single-Operation Context
• CWE-676 Dangerous Functions: Why strcpy Keeps Biting and What to Use
• CWE-680 Integer Overflow to Buffer Overflow: Allocation Math Gone Wrong
• CWE-681 Incorrect Conversion Between Numeric Types Explained
• CWE-682 Incorrect Calculation: When Bad Math Becomes a Security Bug
• CWE-683 Wrong Argument Order in Function Calls: Small Typo, Real Impact
• CWE-684 Incorrect Provision of Specified Functionality
• CWE-685 Function Call With the Wrong Number of Arguments
• CWE-686 Function Call With Incorrect Argument Type
• CWE-687 Function Call With Incorrectly Specified Argument Value
• CWE-688 Wrong Variable or Reference Passed as an Argument
• CWE-689 Permission Race Condition During Resource Copy
• CWE-69 Windows ::DATA Alternate Data Streams: Risk and Fixes
• CWE-690 Unchecked Return Value to NULL Pointer Dereference
• CWE-691 Insufficient Control Flow Management: Goto Fail and Beyond
• CWE-692 Incomplete Denylist to XSS: Why Blocking script Tags Fails
• CWE-693 Protection Mechanism Failure: Missing, Weak or Ignored
• CWE-694 Multiple Resources With Duplicate Identifier
• CWE-695 Use of Low-Level Functionality Your Framework Prohibits
• CWE-696 Incorrect Behavior Order: Right Steps, Wrong Sequence
• CWE-697 Incorrect Comparison in Security Checks
• CWE-698 Execution After Redirect: Why Redirects Need an Exit
• CWE-7 J2EE Missing Custom Error Page: Stop Leaking Stack Traces
• CWE-703 Improper Check or Handling of Exceptional Conditions
• CWE-704 Incorrect Type Conversion or Cast: Loose Equality to Truncation
• CWE-705 Incorrect Control Flow Scoping: The Goto Fail Family
• CWE-706 Use of Incorrectly-Resolved Name or Reference
• CWE-707 Improper Neutralization: The Root of Injection Bugs
• CWE-708 Incorrect Ownership Assignment: Causes and Fixes
• CWE-710 Improper Adherence to Coding Standards Explained
• CWE-72 Apple HFS+ Alternate Data Stream Path: Explained
• CWE-73 External Control of File Name or Path: Find and Fix
• CWE-732 Incorrect Permission Assignment: How to Find and Fix It
• CWE-733 Compiler Optimization Removes Security-Critical Code
• CWE-74 Injection: Special Elements Sent Downstream, and the Fix
• CWE-749 Exposed Dangerous Method or Function: Lock Down the API
• CWE-75 Special Element Injection: Sanitizing Across Planes
• CWE-754 Improper Check for Unusual or Exceptional Conditions
• CWE-755 Improper Handling of Exceptional Conditions Explained
• CWE-756 Missing Custom Error Page: Stop Leaking Stack Details
• CWE-757 Algorithm Downgrade: Negotiating Down to Weak Crypto
• CWE-758 Reliance on Undefined or Implementation-Defined Behavior
• CWE-759 One-Way Hash Without a Salt: Password Storage Done Right
• CWE-76 Equivalent Special Elements: When Filters Miss Twins
• CWE-760 One-Way Hash with a Predictable Salt: Why It Fails
• CWE-761 Free of Pointer Not at Start of Buffer in C
• CWE-762 Mismatched Memory Management Routines in C and C++
• CWE-763 Release of Invalid Pointer or Reference in C and C++
• CWE-764 Multiple Locks of a Critical Resource: Deadlocks and DoS
• CWE-765 Multiple Unlocks of a Critical Resource Explained
• CWE-766 Critical Data Element Declared Public in Java and C#
• CWE-767 Access to Critical Private Variable via Public Method
• CWE-768 Incorrect Short Circuit Evaluation: Skipped Side Effects
• CWE-77 Command Injection: How It Happens and How to Fix It
• CWE-770 Allocation of Resources Without Limits or Throttling
• CWE-771 Missing Reference to Active Allocated Resource
• CWE-772 Missing Release of Resource After Effective Lifetime
• CWE-773 Missing Reference to Active File Descriptor or Handle
• CWE-774 Allocating File Descriptors Without Limits or Throttling
• CWE-775 Missing Release of File Descriptor or Handle: Fixing Leaks
• CWE-776 XML Entity Expansion (Billion Laughs): How to Stop It
• CWE-777 Regular Expression without Anchors: Validation Bypass
• CWE-778 Insufficient Logging: What Your Logs Must Record
• CWE-779 Logging of Excessive Data: When Logs Hide Attacks
• CWE-78 OS Command Injection: Causes, Examples and Fixes
• CWE-780 Use of RSA without OAEP: Why Padding Matters
• CWE-781 IOCTL METHOD_NEITHER Address Validation Explained
• CWE-782 Exposed IOCTL with Insufficient Access Control
• CWE-783 Operator Precedence Logic Error and Auth Bypass
• CWE-784 Reliance on Cookies without Validation in Security Decisions
• CWE-785 Path Manipulation Function without Maximum-sized Buffer
• CWE-786 Access of Memory Location Before Start of Buffer
• CWE-787 Out-of-bounds Write: How It Happens and How to Fix It
• CWE-788 Access of Memory Location After End of Buffer
• CWE-789 Memory Allocation with Excessive Size Value
• CWE-79 Cross-site Scripting: How It Happens and How to Fix It
• CWE-790 Improper Filtering of Special Elements Explained
• CWE-791 Incomplete Filtering of Special Elements
• CWE-792 Incomplete Filtering of One or More Instances
• CWE-793 Only Filtering One Instance of a Special Element
• CWE-794 Incomplete Filtering of Multiple Instances of Special Elements
• CWE-795 Only Filtering Special Elements at a Specified Location
• CWE-796 Only Filtering Special Elements Relative to a Marker
• CWE-797 Only Filtering Special Elements at an Absolute Position
• CWE-798 Use of Hard-coded Credentials: Find Them and Remove Them
• CWE-799 Improper Control of Interaction Frequency: Rate Limits
• CWE-8 J2EE Entity Bean Declared Remote: What Goes Wrong
• CWE-80 Basic XSS: Unescaped Script-Related HTML Characters
• CWE-804 Guessable CAPTCHA: How It Happens and How to Fix It
• CWE-805 Buffer Access with Incorrect Length Value, Explained
• CWE-806 Buffer Access Using Size of Source Buffer
• CWE-807: Trusting Cookies and Hidden Fields in Security Decisions
• CWE-81 XSS in Error Message Pages: How to Fix It
• CWE-82 XSS in IMG Tag Attributes: Cause and Fix
• CWE-820 Missing Synchronization: Shared State Without a Lock
• CWE-821 Incorrect Synchronization: Locks That Do Not Protect
• CWE-822 Untrusted Pointer Dereference in C and C++
• CWE-823 Use of Out-of-range Pointer Offset: Causes and Fixes
• CWE-824 Access of Uninitialized Pointer: Causes and Fixes
• CWE-825 Expired Pointer Dereference (Use After Free Family)
• CWE-826 Premature Release of Resource During Expected Lifetime
• CWE-827 Improper Control of Document Type Definition (DTD)
• CWE-828 Signal Handlers That Are Not Asynchronous-Safe
• CWE-829: Including Code from an Untrusted Control Sphere
• CWE-83 XSS in Attributes: javascript URIs and Event Handlers
• CWE-830 Inclusion of Web Functionality from an Untrusted Source
• CWE-831 Signal Handler Function Associated with Multiple Signals
• CWE-832 Unlock of a Resource that is not Locked
• CWE-833 Deadlock: When Threads Wait for Each Other Forever
• CWE-834 Excessive Iteration: Loops an Attacker Can Stretch
• CWE-835 Infinite Loop: Unreachable Exit Conditions in Parsers
• CWE-836 Use of Password Hash Instead of Password for Authentication
• CWE-837 Improper Enforcement of a Single, Unique Action
• CWE-838 Inappropriate Encoding for Output Context: Causes and Fixes
• CWE-839 Numeric Range Comparison Without Minimum Check
• CWE-84 XSS with Encoded URI Schemes: Why Filters Miss Them
• CWE-841 Improper Enforcement of Behavioral Workflow
• CWE-842 Placement of User into Incorrect Group: Risks and Fixes
• CWE-843 Type Confusion: How It Happens and How to Fix It
• CWE-85 Doubled Character XSS: Why One-Pass Filters Fail
• CWE-86 Invalid Characters in Web Identifiers: XSS Bypass
• CWE-862 Missing Authorization: How It Happens and How to Fix It
• CWE-863 Incorrect Authorization: Why a Check Still Fails
• CWE-87 Alternate XSS Syntax: Unusual Script Forms and Fixes
• CWE-88 Argument Injection: How It Happens and How to Fix It
• CWE-89 SQL Injection: How It Happens and How to Fix It
• CWE-9 Weak Access Permissions for EJB Methods Explained
• CWE-90 LDAP Injection: How It Happens and How to Fix It
• CWE-908 Use of Uninitialized Resource: Causes and Fixes
• CWE-909 Missing Initialization of Resource: How to Prevent It
• CWE-91 XML Injection: How It Happens and How to Fix It
• CWE-910 Use of Expired File Descriptor: Causes and Fixes
• CWE-911 Improper Update of Reference Count: What Goes Wrong
• CWE-912 Hidden Functionality: Backdoors, Easter Eggs and Defaults
• CWE-913 Improper Control of Dynamically-Managed Code Resources
• CWE-914 Dynamically-Identified Variables: The extract() Problem
• CWE-915 Mass Assignment: Dynamically-Determined Object Attributes
• CWE-916 Password Hash With Insufficient Computational Effort
• CWE-917 Expression Language Injection: From JSP to Log4Shell
• CWE-918 Server-Side Request Forgery (SSRF): Causes and Fixes
• CWE-920 Improper Restriction of Power Consumption Explained
• CWE-921 Sensitive Data in Storage Without Access Control
• CWE-922 Insecure Storage of Sensitive Information: Find and Fix
• CWE-923 Improper Restriction of Communication Channel Endpoints
• CWE-924 Message Integrity During Transmission: How to Fix It
• CWE-925 Improper Verification of Intent by Broadcast Receiver
• CWE-926 Improper Export of Android Application Components
• CWE-927 Implicit Intents for Sensitive Data on Android
• CWE-93 CRLF Injection: Headers, Logs and How to Stop It
• CWE-939 Improper Authorization in Custom URL Scheme Handlers
• CWE-94 Code Injection: How It Happens and How to Fix It
• CWE-940 Improper Verification of Source of a Communication Channel
• CWE-941 Incorrectly Specified Destination in a Communication Channel
• CWE-942 Permissive Cross-domain Policy: Risks and Fixes
• CWE-943 Data Query Logic Injection: How It Happens and Fixes
• CWE-95 Eval Injection: Why eval() on Input Goes Wrong
• CWE-96 Static Code Injection: Input Written Into Code Files
• CWE-97 Server-Side Includes Injection Explained
• CWE-98 PHP File Inclusion: How It Happens and How to Fix It
• CWE-99 Resource Injection: Attacker-Chosen File and Port Names

Frequently asked questions

Last reviewed: 19 October 2026.