The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-180Incorrect Behavior Order: Validate Before CanonicalizeVariant44
CWE-181Incorrect Behavior Order: Validate Before FilterVariant0
CWE-182Collapse of Data into Unsafe ValueBase4
CWE-183Permissive List of Allowed InputsBase54
CWE-184Incomplete List of Disallowed InputsBase234
CWE-185Incorrect Regular ExpressionClass34
CWE-186Overly Restrictive Regular ExpressionBase2
CWE-187Partial String ComparisonVariant18
CWE-188Reliance on Data/Memory LayoutBase2
CWE-190Integer Overflow or WraparoundBase1,672
CWE-191Integer Underflow (Wrap or Wraparound)Base480
CWE-192Integer Coercion ErrorVariant7
CWE-193Off-by-one ErrorBase143
CWE-194Unexpected Sign ExtensionVariant4
CWE-195Signed to Unsigned Conversion ErrorVariant33
CWE-196Unsigned to Signed Conversion ErrorVariant9
CWE-197Numeric Truncation ErrorBase97
CWE-198Use of Incorrect Byte OrderingVariant2
CWE-20Improper Input ValidationClass5,282
CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass4,502
Page 17 of 49 · 969 total
PreviousNext