CWE trends
Compare monthly CVE volume across vulnerability categories, then explore changes in the CWE classes behind them.
Area height = monthly CVE countColors = broader weakness categories
Click a category band to inspect that month's CVEs, or a legend item for mapped CWEs
Over time
Last 12 months
Each row is one selected CWE. Bars show how many CVEs were published in each month; click a bar to inspect that month's CVE list. The percentage at the right compares the latest month with the first non-zero month in the last year.
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Click a bar to inspect that month's CVEs
CWE-862
Missing Authorization
Click a bar to inspect that month's CVEs
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Click a bar to inspect that month's CVEs
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Click a bar to inspect that month's CVEs
CWE-416
Use After Free
Click a bar to inspect that month's CVEs
Most Used CWEs
Last 12 months
Select CWEs to add or remove them from the chart. 12-mo compares latest vs first active month.
| # | CWE | 12-mo | |
|---|---|---|---|
| 1 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | +137% | |
| 2 | CWE-862 Missing Authorization | +232% | |
| 3 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | +56% | |
| 4 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | +334% | |
| 5 | CWE-416 Use After Free | +1189% | |
| 6 | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | +6% | |
| 7 | CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | +325% | |
| 8 | CWE-863 Incorrect Authorization | +824% | |
| 9 | CWE-918 Server-Side Request Forgery (SSRF) | +538% | |
| 10 | CWE-125 Out-of-bounds Read | +1103% | |
| 11 | CWE-639 Authorization Bypass Through User-Controlled Key | +621% | |
| 12 | CWE-94 Improper Control of Generation of Code ('Code Injection') | +255% | |
| 13 | CWE-122 Heap-based Buffer Overflow | +938% | |
| 14 | CWE-20 Improper Input Validation | +215% | |
| 15 | CWE-787 Out-of-bounds Write | +586% | |
| 16 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor | +222% | |
| 17 | CWE-306 Missing Authentication for Critical Function | +317% | |
| 18 | CWE-284 Improper Access Control | +82% | |
| 19 | CWE-121 Stack-based Buffer Overflow | +279% | |
| 20 | CWE-502 Deserialization of Untrusted Data | +420% | |
| 21 | CWE-352 Cross-Site Request Forgery (CSRF) | -4% | |
| 22 | CWE-770 Allocation of Resources Without Limits or Throttling | +576% | |
| 23 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | +87% | |
| 24 | CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') | +107% | |
| 25 | CWE-400 Uncontrolled Resource Consumption | +864% | |
| 26 | CWE-287 Improper Authentication | +982% | |
| 27 | CWE-434 Unrestricted Upload of File with Dangerous Type | -7% | |
| 28 | CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | -27% | |
| 29 | CWE-190 Integer Overflow or Wraparound | +1414% | |
| 30 | CWE-285 Improper Authorization | +46% |