Across 44,476 OSV advisory records, cross-site scripting (CWE-79) is the most common labelled weakness with 3,005 records, ahead of path traversal (1,958) and uncontrolled resource consumption (1,462). Each ecosystem has its own signature: prototype pollution in npm, deserialization in Maven, path traversal first in PyPI and Go.
Method
We downloaded the per-ecosystem OSV dumps on 19 October 2026 and set aside the malware records. For the 44,476 remaining advisory records we read the database_specific.cwe_ids list. Of these, 15,137 (34%) carry no CWE, mostly ecosystem database records, so the counts below describe labelled records only. A record with several CWEs counts for each one. These are records, not unique vulnerabilities.
Overall
| CWE | Meaning | Records |
|---|---|---|
| CWE-79 | Cross-site scripting | 3,005 |
| CWE-22 | Path traversal | 1,958 |
| CWE-400 | Uncontrolled resource consumption | 1,462 |
| CWE-200 | Exposure of sensitive information | 1,323 |
| CWE-20 | Improper input validation | 1,323 |
| CWE-863 | Incorrect authorization | 1,086 |
| CWE-862 | Missing authorization | 931 |
| CWE-918 | Server-side request forgery | 923 |
| CWE-94 | Code injection | 882 |
| CWE-770 | Allocation without limits | 831 |
By ecosystem
The top six labelled weaknesses by ecosystem, with record counts:
- npm: CWE-79 (924), CWE-22 (569), CWE-1321 prototype pollution (561), CWE-400 (418), CWE-506 embedded malicious code (405), CWE-78 OS command injection (340).
- PyPI: CWE-22 (535), CWE-79 (514), CWE-20 (318), CWE-200 (307), CWE-400 (299), CWE-94 (272).
- Maven: CWE-79 (972), CWE-502 deserialization (414), CWE-862 (385), CWE-352 cross-site request forgery (380), CWE-20 (364), CWE-22 (338).
- Go: CWE-22 (367), CWE-863 (366), CWE-400 (274), CWE-79 (264), CWE-200 (263), CWE-862 (232).
Reading the pattern
Libraries reflect their language. A language with dynamic objects and merging helpers invites prototype pollution. A language with a long history of object serialization carries deserialization flaws. Web frameworks everywhere repeat the same output encoding mistakes, which is why cross-site scripting is first in two of the four lists and in the top four of all of them.
The labelled share also matters. Records from ecosystem databases such as the Go database or the PyPI advisory database often have no CWE, so the lists lean toward whatever GitHub-reviewed records say.
What to do with it
For a team, the use is practical. If you ship npm packages, add a test that merges untrusted objects. If you ship Java services, ban native deserialization of untrusted input. For any web-facing library, check that output is encoded for its context.
These counts say what was reported and labelled, not what exists in your code. Run a scan on your own repository before you assume your risk mirrors the average.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Run the scan and see which of these weakness types a code scanner would report for you.
Quick check
Why do the counts count records and not vulnerabilities?
One flaw can have several records across databases, so the totals overstate unique flaws.
Is a high CWE count proof the ecosystem is weaker in that area?
No. It reflects what was found, reported and labelled in that ecosystem.
Sources
- OSV data sources and dumps, per-ecosystem OSV dumps downloaded on 19 October 2026.
Last reviewed: 19 October 2026.
