CWEs that violate the CWE Top 25 standard
The following table lists the CWEs that violate the CWE Top 25 standard. Only the supported CWEs on the most recent list will cause an application to fail a policy that includes the Auto-Update CWE Top 25 policy rule.
| CWE ID | CWE name | SAST support | DAST support | Veracode severity | Years on list |
|---|---|---|---|---|---|
| 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Yes | Yes | 3 - Medium | 2019-2025 |
| 23 | Relative Path Traversal | No | No | N/A | 2019-2025 |
| 73 | External Control of File Name or Path | Yes | No | 3 - Medium | 2019-2025 |
| 77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Yes | No | 5 - Very High (Critical) | 2021-2025 |
| 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Yes | Yes | 5 - Very High (Critical) | 2019-2025 |
| 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Yes | Yes | 3 - Medium | 2019-2025 |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Yes | Yes | 3 - Medium | 2019-2025 |
| 81 | Improper Neutralization of Script in an Error Message Web Page | No | No | 3 - Medium | 2019-2025 |
| 83 | Improper Neutralization of Script in Attributes in a Web Page | No | Yes | 3 - Medium | 2019-2025 |
| 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | Yes | No | 3 - Medium | 2019-2025 |
| 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Yes | Yes | 4 - High | 2019-2025 |
| 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | Yes | No | 3 - Medium | 2019-2025 |
| 91 | XML Injection (aka Blind XPath Injection) | Yes | Yes | 3 - Medium | 2019-2020, 2022-2025 |
| 94 | Improper Control of Generation of Code ('Code Injection') | Yes | No | 3 - Medium | 2019-2020, 2022-2025 |
| 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | Yes | Yes | 5 - Very High (Critical) | 2019-2020, 2022-2025 |
| 98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | Yes | Yes | 4 - High | 2019-2020, 2022-2025 |
| 103 | Struts: Incomplete validate() Method Definition | Yes | No | 3 - Medium | 2019-2025 |
| 104 | Struts: Form Bean Does Not Extend Validation Class | Yes | No | 3 - Medium | 2019-2025 |
| 112 | Missing XML Validation | Yes | No | 3 - Medium | 2019-2025 |
| 119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | No | No | N/A | 2019-2024 |
| 120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | No | No | 5 - Very High (Critical) | 2019-2025 |
| 121 | Stack-based Buffer Overflow | Yes | No | 5 - Very High (Critical) | 2019-2025 |
| 122 | Heap-based Buffer Overflow | No | No | 5 - Very High (Critical) | 2025 |
| 125 | Out-of-bounds Read | Yes | No | 3 - Medium | 2019-2025 |
| 131 | Incorrect Calculation of Buffer Size | No | No | N/A | 2019-2024 |
| 135 | Incorrect Calculation of Multi-Byte String Length | Yes | No | 5 - Very High (Critical) | 2019-2024 |
| 185 | Incorrect Regular Expression | Yes | No | 2 - Low | 2019-2020, 2022-2025 |
| 190 | Integer Overflow or Wraparound | Yes | No | 5 - Very High (Critical) | 2019-2024 |
| 200 | Exposure of Sensitive Information to an Unauthorized Actor | Yes | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 201 | Insertion of Sensitive Information Into Sent Data | Yes | No | 2 - Low | 2019-2021, 2024-2025 |
| 209 | Generation of Error Message Containing Sensitive Information | Yes | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 215 | Insertion of Sensitive Information Into Debugging Code | Yes | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 259 | Use of Hard-coded Password | Yes | Yes | 3 - Medium | 2019-2024 |
| 269 | Improper Privilege Management | No | No | 3 - Medium | 2019-2020, 2023-2024 |
| 272 | Least Privilege Violation | Yes | No | 3 - Medium | 2019-2020, 2023-2024 |
| 276 | Incorrect Default Permissions | No | No | 3 - Medium | 2021-2023 |
| 284 | Improper Access Control | Yes | No | 3 - Medium | 2025 |
| 285 | Improper Authorization | Yes | No | 3 - Medium | 2019-2020, 2023-2024 |
| 287 | Improper Authentication | Yes | Yes | 4 - High | 2019-2024 |
| 295 | Improper Certificate Validation | Yes | No | 3 - Medium | 2019 |
| 306 | Missing Authentication for Critical Function | No | No | 3 - Medium | 2020-2025 |
| 321 | Use of Hard-coded Cryptographic Key | Yes | Yes | 3 - Medium | 2019-2024 |
| 346 | Origin Validation Error | Yes | No | 3 - Medium | 2019-2020, 2023-2024 |
| 350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | Yes | No | 3 - Medium | 2019-2020, 2023-2024 |
| 352 | Cross-Site Request Forgery (CSRF) | Yes | Yes | 3 - Medium | 2019-2025 |
| 359 | Exposure of Private Personal Information to an Unauthorized Actor | Yes | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | No | No | N/A | 2022-2023 |
| 366 | Race Condition within a Thread | Yes | No | 3 - Medium | 2022-2023 |
| 367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Yes | No | 3 - Medium | 2022-2023 |
| 400 | Uncontrolled Resource Consumption | No | No | 2 - Low | 2019-2020, 2022, 2024 |
| 416 | Use After Free | Yes | No | 2 - Low | 2019-2025 |
| 426 | Untrusted Search Path | Yes | No | 3 - Medium | 2019 |
| 427 | Uncontrolled Search Path Element | Yes | No | 3 - Medium | 2019 |
| 434 | Unrestricted Upload of File with Dangerous Type | No | Yes | 4 - High | 2019-2025 |
| 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | Yes | No | 3 - Medium | 2019-2025 |
| 476 | NULL Pointer Dereference | No | No | 2 - Low | 2019-2025 |
| 497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Yes | No | 2 - Low | 2019-2021, 2024-2025 |
| 498 | Cloneable Class Containing Sensitive Information | No | No | 2 - Low | 2019-2021, 2024-2025 |
| 502 | Deserialization of Untrusted Data | Yes | Yes | 3 - Medium | 2019-2025 |
| 522 | Insufficiently Protected Credentials | Yes | Yes | 3 - Medium | 2020-2021 |
| 526 | Cleartext Storage of Sensitive Information in an Environment Variable | No | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 530 | Exposure of Backup File to an Unauthorized Control Sphere | No | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | No | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 548 | Exposure of Information Through Directory Listing | No | Yes | 2 - Low | 2019-2021, 2024-2025 |
| 564 | SQL Injection: Hibernate | Yes | No | 4 - High | 2019-2025 |
| 566 | Authorization Bypass Through User-Controlled SQL Primary Key | Yes | No | 3 - Medium | 2019-2020, 2023-2024 |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | Yes | 3 - Medium | 2019-2025 |
| 611 | Improper Restriction of XML External Entity Reference | Yes | Yes | 3 - Medium | 2019-2022 |
| 615 | Inclusion of Sensitive Information in Source Code Comments | Yes | No | 2 - Low | 2019-2021, 2024-2025 |
| 618 | Exposed Unsafe ActiveX Method | Yes | No | 5 - Very High (Critical) | 2019-2025 |
| 639 | Authorization Bypass Through User-Controlled Key | Yes | No | 4 - High | 2019-2020, 2023-2025 |
| 665 | Improper Initialization | Yes | No | 2 - Low | 2019-2021, 2024-2025 |
| 693 | Protection Mechanism Failure | Yes | Yes | 3 - Medium | 2019-2024 |
| 708 | Incorrect Ownership Assignment | Yes | No | 4 - High | 2019-2020, 2023-2024 |
| 732 | Incorrect Permission Assignment for Critical Resource | Yes | No | 3 - Medium | 2019-2021 |
| 770 | Allocation of Resources Without Limits or Throttling | No | No | N/A | 2025 |
| 772 | Missing Release of Resource after Effective Lifetime | No | No | N/A | 2019 |
| 787 | Out-of-bounds Write | Yes | No | 3 - Medium | 2019-2025 |
| 798 | Use of Hard-coded Credentials | Yes | No | 3 - Medium | 2019-2024 |
| 830 | Inclusion of Web Functionality from an Untrusted Source | No | Yes | 2 - Low | 2019-2020, 2022-2025 |
| 862 | Missing Authorization | No | Yes | 2 - Low | 2020-2025 |
| 863 | Incorrect Authorization | No | No | N/A | 2023-2025 |
| 915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Yes | No | 3 - Medium | 2019-2025 |
| 918 | Server-Side Request Forgery (SSRF) | Yes | Yes | 3 - Medium | 2019-2025 |
| 942 | Permissive Cross-domain Security Policy with Untrusted Domains | Yes | No | 3 - Medium | 2019-2020, 2023-2024 |
| 1174 | ASP.NET Misconfiguration: Improper Model Validation | Yes | No | 2 - Low | 2019-2025 |