The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-180Incorrect Behavior Order: Validate Before CanonicalizeVariant28
CWE-181Incorrect Behavior Order: Validate Before FilterVariant0
CWE-182Collapse of Data into Unsafe ValueBase3
CWE-183Permissive List of Allowed InputsBase45
CWE-184Incomplete List of Disallowed InputsBase178
CWE-185Incorrect Regular ExpressionClass29
CWE-186Overly Restrictive Regular ExpressionBase2
CWE-187Partial String ComparisonVariant13
CWE-188Reliance on Data/Memory LayoutBase2
CWE-190Integer Overflow or WraparoundBase1,250
CWE-191Integer Underflow (Wrap or Wraparound)Base357
CWE-192Integer Coercion ErrorVariant7
CWE-193Off-by-one ErrorBase109
CWE-194Unexpected Sign ExtensionVariant4
CWE-195Signed to Unsigned Conversion ErrorVariant21
CWE-196Unsigned to Signed Conversion ErrorVariant7
CWE-197Numeric Truncation ErrorBase67
CWE-198Use of Incorrect Byte OrderingVariant1
CWE-20Improper Input ValidationClass4,628
CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass3,744
Page 17 of 49 · 969 total
PreviousNext