CWE Top 25 Most Dangerous Software Weaknesses 2024
Explore MITRE's annual CWE Top 25 list of the most dangerous software weaknesses for 2024. View rankings, historical trends, CVE counts, and severity scores. Based on analysis of 31,770 real-world vulnerability records.
CWE Top 25 Most Dangerous Software Weaknesses
CVE records from 2023-2024 • Released: June 25, 2024
Based on analysis of 31,770 CVE records
| Rank | CWE ID | Name | Score | CVE Count | Avg CVSS |
|---|---|---|---|---|---|
| 1 | CWE-79 | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) | 45.54 | 4,442 | 6.2 |
| 2 | CWE-787 | Out-of-bounds Write | 43.67 | 3,842 | 7.3 |
| 3 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) | 34.27 | 1,467 | 8.7 |
| 4 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) | 24.66 | 819 | 8.6 |
| 5 | CWE-352 | Cross-Site Request Forgery (CSRF) | 23.08 | 345 | 8.3 |
| 6 | CWE-434 | Unrestricted Upload of File with Dangerous Type | 20.26 | 322 | 8.4 |
| 7 | CWE-125 | Out-of-bounds Read | 18.64 | 2,117 | 5.5 |
| 8 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) | 16.44 | 415 | 9.3 |
| 9 | CWE-20 | Improper Input Validation | 15.98 | 2,318 | 6.7 |
| 10 | CWE-862 | Missing Authorization | 15.60 | 1,168 | 7.1 |
| 11 | CWE-476 | NULL Pointer Dereference | 15.34 | 1,625 | 5.8 |
| 12 | CWE-287 | Improper Authentication | 15.15 | 1,117 | 7.0 |
| 13 | CWE-798 | Use of Hard-coded Credentials | 13.84 | 262 | 8.8 |
| 14 | CWE-918 | Server-Side Request Forgery (SSRF) | 13.74 | 306 | 8.6 |
| 15 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 13.60 | 819 | 7.5 |
| 16 | CWE-416 | Use After Free | 12.89 | 1,151 | 7.2 |
| 17 | CWE-863 | Incorrect Authorization | 11.97 | 969 | 6.9 |
| 18 | CWE-94 | Improper Control of Generation of Code (Code Injection) | 11.72 | 436 | 8.3 |
| 19 | CWE-502 | Deserialization of Untrusted Data | 10.29 | 237 | 8.8 |
| 20 | CWE-77 | Improper Neutralization of Special Elements used in a Command (Command Injection) | 9.45 | 208 | 9.3 |
| 21 | CWE-306 | Missing Authentication for Critical Function | 9.38 | 744 | 6.9 |
| 22 | CWE-269 | Improper Privilege Management | 8.92 | 636 | 7.2 |
| 23 | CWE-401 | Missing Release of Memory after Effective Lifetime | 8.70 | 772 | 6.2 |
| 24 | CWE-190 | Integer Overflow or Wraparound | 8.60 | 667 | 6.7 |
| 25 | CWE-522 | Insufficiently Protected Credentials | 8.54 | 283 | 8.0 |
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
Out-of-bounds Write
Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Cross-Site Request Forgery (CSRF)
Unrestricted Upload of File with Dangerous Type
Out-of-bounds Read
Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Improper Input Validation
Missing Authorization
NULL Pointer Dereference
Improper Authentication
Use of Hard-coded Credentials
Server-Side Request Forgery (SSRF)
Improper Restriction of Operations within the Bounds of a Memory Buffer
Use After Free
Incorrect Authorization
Improper Control of Generation of Code (Code Injection)
Deserialization of Untrusted Data
Improper Neutralization of Special Elements used in a Command (Command Injection)
Missing Authentication for Critical Function
Improper Privilege Management
Missing Release of Memory after Effective Lifetime
Integer Overflow or Wraparound
Insufficiently Protected Credentials
Click any row to view detailed information about that weakness
View official 2024 list on MITREUnderstanding the CWE Top 25
The CWE Top 25 Most Dangerous Software Weaknesses is a demonstrative list of the most common and impactful software security weaknesses. This list is compiled annually by MITRE using a data-driven approach that analyzes real-world vulnerability data from the National Vulnerability Database (NVD).
Unlike generic security checklists, the Top 25 is based on actual CVE records, making it a concrete measure of which weaknesses are causing the most security problems in production software. The 2024 list analyzed 31,770 CVE records to identify the weaknesses with the highest combined prevalence and severity.
How Rankings Are Calculated
Each CWE receives a score based on three key factors:
Prevalence (CVE Count)
How frequently this weakness appears in reported vulnerabilities. More occurrences indicate a widespread problem affecting many software systems.
Severity (Average CVSS)
The typical impact when this weakness is exploited, measured by CVSS scores. Higher severity means more dangerous consequences when the weakness is present.
Combined Score
MITRE applies a formula combining prevalence and severity to produce a final score. Weaknesses that are both common AND severe rank highest.
Why the Top 25 Matters
For Development Teams
- ✓Prioritize security training on the most critical weaknesses
- ✓Configure static analysis tools to focus on Top 25 patterns
- ✓Create secure coding standards based on real-world data
- ✓Build security champions program around Top 25 expertise
For Security Teams
- ✓Triage vulnerability findings by Top 25 membership
- ✓Justify security budget with industry-recognized priorities
- ✓Track remediation progress against known critical issues
- ✓Demonstrate compliance with security best practices
2024 Key Insights
Top 3 Most Dangerous Weaknesses
- #1CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) - 4,442 CVEs, Avg CVSS 6.2
- #2CWE-787: Out-of-bounds Write - 3,842 CVEs, Avg CVSS 7.3
- #3CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) - 1,467 CVEs, Avg CVSS 8.7
These three weaknesses alone account for 9,751 CVEs - representing a significant portion of the total analyzed vulnerabilities. Organizations that address these three categories can dramatically reduce their attack surface.
How to Use This Tool
Year Comparison
Use the year selector to switch between different annual lists. Trend indicators automatically show how rankings changed from the previous year:
Click for Details
Click any CWE entry to view comprehensive details including description, consequences, mitigation strategies, detection methods, and code examples. This helps you understand not just what the weakness is, but how to prevent and remediate it in your code.
Additional Resources
Need Professional IT Services?
Our IT professionals can help optimize your infrastructure and improve your operations.
Frequently Asked Questions
Common questions about the CWE Top 25 Most Dangerous Software Weaknesses 2024
The CWE Top 25 Most Dangerous Software Weaknesses is an annual list compiled by MITRE that demonstrates the most widespread and critical software weaknesses. The list is calculated from real-world vulnerability data in the National Vulnerability Database (NVD), providing a data-driven view of the most impactful security issues affecting software today.
Explore More Tools
Continue with these related tools
CWE Lookup Tool
Search and explore Common Weakness Enumeration database
CVE Vulnerability Search
Search and analyze Common Vulnerabilities and Exposures records
Security Headers Analyzer
Analyze HTTP security headers and get recommendations
Hash Generator
Generate MD5, SHA-256, and SHA-512 hashes
⚠️ Security Notice
This tool is provided for educational and authorized security testing purposes only. Always ensure you have proper authorization before testing any systems or networks you do not own. Unauthorized access or security testing may be illegal in your jurisdiction. All processing happens client-side in your browser - no data is sent to our servers.