The Most Common CWEs in 23,934 CVEs, 61 KEV Entries and 1,522 Advisories

We counted the weakness types (CWEs) in three public datasets for 1 September to 16 October 2026: every non-rejected CVE in the NVD, the 61 CVEs CISA added to KEV, and the 1,522 unique GitHub advisories for open source packages. Cross-site scripting (CWE-79) is the most common weakness across all CVEs, at 8.1%. It does not appear in a single one of the 61 KEV additions.

The three lists rank weaknesses very differently. That gap is the useful part, so the tables and the code to reproduce them are below.

How we counted

All data was downloaded on 18 October 2026.

1. All CVEs. NVD CVE API 2.0 filtered by publication date from 2026-09-01 to 2026-10-16 returned 24,141 records. 207 were rejected, leaving 23,934. We collected every weaknesses[].description[].value per CVE, deduplicated within a CVE.
2. KEV. The cwes field of the CISA KEV JSON feed, for entries with dateAdded in the same window (61 entries, catalog version 2026.10.16).
3. GitHub advisories. database_specific.cwe_ids in OSV's GHSA records published in the window and not withdrawn, deduplicated by ID.

# NVD: repeat with startIndex=0,2000,4000... and sleep between calls
curl -sS "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-09-01T00:00:00.000Z&pubEndDate=2026-10-16T23:59:59.999Z&resultsPerPage=2000&startIndex=0"

curl -sS -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

import collections

# nvd_live: non-rejected NVD CVE objects; kev: KEV entries in the window; ghsa: unique GHSA records
def cwes(cve):
    return {d["value"] for w in cve.get("weaknesses", []) for d in w["description"]}

nvd_counts = collections.Counter(c for x in nvd_live for c in cwes(x))
kev_counts = collections.Counter(c for v in kev for c in set(v["cwes"]))
ghsa_counts = collections.Counter(c for r in ghsa
                                  for c in set(r["database_specific"].get("cwe_ids", [])))
print(nvd_counts.most_common(10))

A CVE with two CWEs counts once under each, so shares can add to more than 100%. We did not exclude the placeholders NVD-CWE-noinfo (20 CVEs) and NVD-CWE-Other (3) from the denominators.

What's affected

All 23,934 CVEs

21,489 CVEs (89.8%) have at least one numeric CWE. 2,431 (10.2%) have no weakness entry. 452 distinct CWEs appear. Of the 21,626 weakness entries, 1,157 are NVD's own (type Primary) and 20,469 come from the CNA (type Secondary).

The 61 KEV additions

All 61 entries carry at least one CWE, 45 distinct in total. With counts this small, treat the order as a hint: CWE-287 leads by a single entry.

The 1,522 GitHub advisories

1,513 of the 1,522 have a CWE.

Grouped view

We grouped CWEs into families. The lists are fixed in the code so you can change them.

Memory safety bugs are rare in the open source package advisories (30 of 1,522) and common in the CVE feed overall (15.1%). Injection and path traversal are over-represented in KEV relative to all CVEs, and XSS is absent.

How to check if you're exposed

Count the families in your own backlog. If you export findings with a CWE column, this gives the same view:

python3 -c '
import csv, collections, sys
rows = csv.DictReader(open(sys.argv[1]))
c = collections.Counter(r["cwe"] for r in rows)
print(c.most_common(10))
' findings.csv

Then compare the top of your list with the KEV table above, not with the all-CVE table.

What to do now

1. Rank fix work by weakness families that appear in KEV, starting with authentication, path traversal, command injection and memory errors on anything internet facing.
2. Don't discard XSS findings, but don't let them set the order. They fill the CVE feed and were absent from KEV in this window.
3. Add authorization tests for object access. Four of the top ten CWEs for all CVEs are access control types (862, 863, 284, 639).
4. Add limits to anything that parses or allocates on user input. CWE-400 and CWE-770 appear in 113 and 66 of the open source advisories.
5. Store the CWE with every finding so you can run this analysis on your own data.

Why it matters

CWE counts describe what developers get wrong, and KEV describes what attackers use. The two lists overlap but they are not the same list. Mixing them leads teams to spend effort on the weaknesses that are most common instead of the ones that are most exploited.

The caveat is size. 61 KEV entries in 46 days is a small sample, and the open source advisories skew to web applications and servers. Rerun the script on a longer window before you set policy.

Try it yourself

Pick the three most common CWEs in your own findings and compare them with the KEV table. Then run a code scan on one service and see which of these families it surfaces. The demo shows a static code scan from start to finish.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD CVE API 2.0
• CISA Known Exploited Vulnerabilities catalog, JSON feed
• OSV npm all.zip
• OSV PyPI all.zip
• OSV Go all.zip
• MITRE CWE list