Most exploited vulnerabilities trace back to a short list of coding and design mistakes that teams keep repeating, and patching CVEs one at a time never removes the cause. The Common Weakness Enumeration (CWE), maintained by MITRE, names those root causes, and the CWE Top 25 ranks the ones behind the most severe and frequent CVEs. This guide covers the 2025 list, its scoring, the CWE hierarchy, mapping, and practical use, with reference tables by class. It is for AppSec engineers, developers and vulnerability managers.
Key takeaways
- The current edition is the 2025 CWE Top 25, announced on 11 December 2025 and built from 39,080 CVE Records published between 1 June 2024 and 1 June 2025.
- Web flaws top the score, injection and memory flaws top exploitation. CWE-79 scores 60.38, but CWE-78 has the most CVEs in CISA's KEV catalogue (20), then CWE-416 and CWE-787.
- Access control and authentication hold five places: CWE-862, CWE-863, CWE-284, CWE-639 and CWE-306, with CWE-862 up five places to fourth.
- Map to Base or Variant entries, never to a category.
- Use the list to remove classes, not to count findings. Tie it to coding standards, SAST rules and supplier requirements, and measure recurrence by CWE.
CWE, CVE and related MITRE projects
MITRE's glossary defines a weakness as "a condition in a software, firmware, hardware, or service component that, under certain circumstances, could contribute" to a vulnerability. A CVE is one vulnerability in one product; its CVE Record can carry CWE IDs stating the root cause, which is the Top 25's raw data.
| Project | Identifies | Role alongside CWE |
|---|---|---|
| CWE | A type of weakness (root cause) | Coding standards, SAST rules, root cause trends |
| CVE | One vulnerability, such as CVE-2025-53770 in SharePoint | Records carry CWE IDs; CVSS gives severity |
| CISA KEV | Vulnerabilities known to be exploited | Basis of the Top 10 KEV Weaknesses list |
| CAPEC | An attack pattern | Links attacks to CWEs |
| CWSS | A 0 to 100 score for a weakness finding | Scores findings with Base Finding, Attack Surface and Environmental metrics |
CWE 4.20 (30 April 2026) holds 944 weaknesses; CWE 5.0 is scheduled for 28 October 2026.
The 2025 CWE Top 25 at a glance
Names shortened. KEV counts CVEs in CISA's Known Exploited Vulnerabilities catalogue; change is against 2024.
| Rank | CWE | Name | Score | KEV | Change |
|---|---|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting (XSS) | 60.38 | 7 | 0 |
| 2 | CWE-89 | SQL Injection | 28.72 | 4 | +1 |
| 3 | CWE-352 | Cross-Site Request Forgery (CSRF) | 13.64 | 0 | +1 |
| 4 | CWE-862 | Missing Authorization | 13.28 | 0 | +5 |
| 5 | CWE-787 | Out-of-bounds Write | 12.68 | 12 | -3 |
| 6 | CWE-22 | Path Traversal | 8.99 | 10 | -1 |
| 7 | CWE-416 | Use After Free | 8.47 | 14 | +1 |
| 8 | CWE-125 | Out-of-bounds Read | 7.88 | 3 | -2 |
| 9 | CWE-78 | OS Command Injection | 7.85 | 20 | -2 |
| 10 | CWE-94 | Code Injection | 7.57 | 7 | +1 |
| 11 | CWE-120 | Classic Buffer Overflow | 6.96 | 0 | New |
| 12 | CWE-434 | Unrestricted File Upload | 6.87 | 4 | -2 |
| 13 | CWE-476 | NULL Pointer Dereference | 6.41 | 0 | +8 |
| 14 | CWE-121 | Stack-based Buffer Overflow | 5.75 | 4 | New |
| 15 | CWE-502 | Deserialization of Untrusted Data | 5.23 | 11 | +1 |
| 16 | CWE-122 | Heap-based Buffer Overflow | 5.21 | 6 | New |
| 17 | CWE-863 | Incorrect Authorization | 4.14 | 4 | +1 |
| 18 | CWE-20 | Improper Input Validation | 4.09 | 2 | -6 |
| 19 | CWE-284 | Improper Access Control | 4.07 | 1 | New |
| 20 | CWE-200 | Sensitive Information Exposure | 4.01 | 1 | -3 |
| 21 | CWE-306 | Missing Authentication (Critical Function) | 3.47 | 11 | +4 |
| 22 | CWE-918 | Server-Side Request Forgery (SSRF) | 3.36 | 0 | -3 |
| 23 | CWE-77 | Command Injection | 3.15 | 2 | -10 |
| 24 | CWE-639 | Authorization Bypass via User-Controlled Key | 2.62 | 0 | +6 |
| 25 | CWE-770 | Unlimited Resource Allocation | 2.54 | 0 | +1 |
MITRE's separate 2025 CWE Top 10 KEV Weaknesses ranks by CISA's KEV catalogue: CWE-78, CWE-416, CWE-787, CWE-306, CWE-502, CWE-22, CWE-94, CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-122 and CWE-79. Use it for fixing deployed products; use the Top 25 for preventing defects in new code.
How the 2025 list was scored
- Data: mappings from CNAs, CISA Vulnrichment and NVD; 9,468 records were re-mapped with CNAs.
- Formula: Score = Fr × Sv × 100, where Fr is the min-max normalised count of CVEs mapped to the CWE and Sv the min-max normalised average CVSS score (v3.0 or v3.1 only).
- Change for 2025: mappings were used "without normalizing them back to View-1003", the NVD view earlier editions rolled entries up to. Hence CWE-120, CWE-121 and CWE-122 appear separately, and older ranks are not directly comparable.
- Limits: internal and SaaS code rarely receives CVEs, so its weaknesses are under-represented.
CWE hierarchy, views and mapping
A Pillar is "the highest-level weakness that cannot be made any more abstract" (CWE-284, CWE-664, CWE-707, CWE-682). A Class is language independent (CWE-119, CWE-862). A Base is specific enough to infer methods (CWE-787). A Variant is tied to a language or technology (CWE-121, CWE-416). Compounds are Chains, such as CWE-680 Integer Overflow to Buffer Overflow, or Composites, such as CWE-384 Session Fixation. Categories group entries and are not weaknesses.
| View | Scope and use |
|---|---|
| CWE-1000 Research Concepts | Every weakness, deep tree from 10 Pillars; precise root cause analysis |
| CWE-699 Software Development | About 400 weaknesses in two levels; training and coding standards |
| CWE-1400 Software Assurance Trends | Every weakness in 22 "Comprehensive Categorization" categories; trend reporting |
| CWE-1003 NVD view | About 130 weaknesses common in NVD; older Top 25 data |
| CWE-1194 Hardware Design | About 100 hardware weaknesses |
Each entry has a mapping usage label: ALLOWED, ALLOWED (with careful review of mapping notes), DISCOURAGED or PROHIBITED (all categories).
Mapping findings to CWE
Scanner output often describes impact ("remote code execution"), not cause. MITRE's guidance asks for weakness language such as "missing authentication".
- State what the code failed to do, not what the attacker achieved.
- Search CWE and pick the most specific Base or Variant; use a Class only when nothing narrower fits, and "never map a vulnerability to a CWE Category".
- Read the usage label and mapping notes, then check parent and child entries for a better fit.
- Record the primary (root cause) and resultant weakness: an unchecked size calculation causing a heap overwrite is CWE-190 then CWE-122.
- Have a second reviewer confirm it, then store it in the ticket and any CVE you publish.
Using the Top 25 in a secure development programme
- Secure coding standards: one control per targeted entry: parameterised queries for CWE-89, context-aware output encoding for CWE-79, deny-by-default object-level authorisation for CWE-862 and CWE-639.
- SAST rules: tag rules by CWE, make Top 25 and KEV-list rules blocking, keep noisy rules advisory, and check which CWE IDs each tool actually detects.
- Triage: KEV-list presence, reachability and exposure first, then CVSS or CWSS.
- Procurement and Secure by Design: ask suppliers which classes they have eliminated. CISA's Secure by Design pledge asks signers to include "accurate Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields" in CVE records and to reduce classes such as "SQL injection, cross-site scripting, and memory safety vulnerabilities".
- AI-generated code: apply the same gates. See the AI Coding Agents Security Guide.
Small versus large organisations: a small web SaaS team should target CWE-79, CWE-89, CWE-862, CWE-639 and CWE-918 via framework defaults. A large organisation should track recurrence per product and fund paved-road libraries for recurring classes. Systems code puts memory safety first; web and API code, access control and injection.
Rolling out a Top 25 programme
- Baseline: map 12 months of findings and incidents to CWE.
- Choose three to five target classes that recur in your data and appear in the Top 25 or KEV list.
- Pilot: run matching SAST rules report-only on two or three repositories for two to four weeks, then make them blocking.
- Eliminate by design with safe defaults (see checklist).
- Expand in rings each quarter; keep rules in version control so a noisy rule can revert to advisory.
- Close the loop: a CWE-tagged root cause review for every critical finding, fed into training.
Mapping to OWASP Top 10 and CAPEC
The OWASP Top 10:2025 analysed 589 CWEs, capped categories at 40 CWEs and chose "to focus on the root cause whenever possible". SSRF was rolled into A01, and A10 is new with 24 CWEs. Rows group entries by theme, not OWASP's exact CWE lists.
| OWASP Top 10:2025 | Related Top 25 entries | CAPEC pattern or test |
|---|---|---|
| A01 Broken Access Control | CWE-862, CWE-863, CWE-284, CWE-639, CWE-22, CWE-352, CWE-918 | CAPEC-126 Path Traversal, CAPEC-62 CSRF, CAPEC-664 SSRF |
| A05 Injection | CWE-79, CWE-89, CWE-78, CWE-77, CWE-94 | CAPEC-63 XSS, CAPEC-66 SQL Injection, CAPEC-88 OS Command Injection |
| A06 Insecure Design | CWE-434 | Threat model misuse cases |
| A07 Authentication Failures | CWE-306; KEV list CWE-288 | CAPEC-115 Authentication Bypass |
| A08 Software or Data Integrity Failures | CWE-502 | CAPEC-586 Object Injection |
| A10 Mishandling of Exceptional Conditions | CWE-476 | Fail-open testing |
| Memory, resources, exposure | CWE-787, CWE-125, CWE-416, CWE-120, CWE-121, CWE-122, CWE-20, CWE-200, CWE-770 | CAPEC-100 Overflow Buffers |
CAPEC-100 Overflow Buffers (related to CWE-120, CWE-119, CWE-131 and CWE-680) has children including CAPEC-8 Buffer Overflow in an API Call, CAPEC-9 in Local Command-Line Utilities, CAPEC-10 via Environment Variables, CAPEC-14 Client-side Injection-induced Buffer Overflow, CAPEC-24 Filter Failure through Buffer Overflow, CAPEC-44 Overflow Binary Resource File, CAPEC-45 via Symbolic Links, CAPEC-46 Overflow Variables and Tags, CAPEC-47 via Parameter Expansion and CAPEC-67 String Format Overflow in syslog(). Exploitation of these weaknesses in internet-facing software is tracked in MITRE ATT&CK as T1190 Exploit Public-Facing Application.
Memory safety weaknesses
Six 2025 entries sit in CWE's Memory Safety category (CWE-787, CWE-416, CWE-125, CWE-120, CWE-121, CWE-122), CWE-476 is closely related, and CWE-416 and CWE-787 alone hold 26 KEV CVEs. CAPEC-100 calls canaries and OS protections "not a complete solution" and puts automatic bounds checking first.
- New code: parsers and network services in a memory-safe language.
- Existing C and C++: AddressSanitizer in test builds, continuous fuzzing, and a ban on unbounded copy functions (CWE-242).
- Incidents: CitrixBleed leaked session tokens that bypassed MFA, and MongoBleed exposed secrets from MongoDB server memory.
Where identity fits
CWE-306 and CWE-288 both rank in the KEV top ten. Hard-coded and default credentials (CWE-798, CWE-1392 Use of Default Credentials, CWE-1394 Use of Default Cryptographic Key) turn one leaked binary into access everywhere, as the Gladinet hard-coded keys exploitation showed. See the Authorisation Models Guide, the Token and Session Security Guide and the Secrets Management Guide.
Reference: further CWE weaknesses by class
IDs checked against CWE 4.20 category pages; shared prefixes written once.
| Class | Weaknesses |
|---|---|
| Injection and neutralisation | Improper Neutralization of: CWE-140 Delimiters, 141 Parameter/Argument Delimiters, 146 Expression/Command Delimiters, 147 Input Terminators, 148 Input Leaders, 149 Quoting Syntax, 152 Macro Symbols, 153 Substitution Characters, 156 Whitespace. CWE-157 Failure to Sanitize Paired Delimiters, CWE-117 Improper Output Neutralization for Logs, CWE-838 Inappropriate Encoding for Output Context, CWE-134 Use of Externally-Controlled Format String |
| Encoding and validation order | Improper Handling of: CWE-173 Alternate Encoding, 175 Mixed Encoding, 176 Unicode Encoding, 178 Case Sensitivity. CWE-174 Double Decoding of the Same Data, CWE-170 Improper Null Termination, CWE-179 Incorrect Behavior Order: Early Validation |
| Memory | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-124 Buffer Underwrite ('Buffer Underflow'), CWE-127 Buffer Under-read, CWE-129 Improper Validation of Array Index, CWE-131 Incorrect Calculation of Buffer Size, Buffer Access with Incorrect Length Value (805) and Using Size of Source Buffer (806), CWE-789 Memory Allocation with Excessive Size Value, CWE-1325 Improperly Controlled Sequential Memory Allocation, CWE-590 Free of Memory not on the Heap, CWE-762 Mismatched Memory Management Routines, CWE-763 Release of Invalid Pointer or Reference, CWE-823 Use of Out-of-range Pointer Offset, CWE-824 Access of Uninitialized Pointer, CWE-825 Expired Pointer Dereference, CWE-911 Improper Update of Reference Count, Deletion (463) and Addition (464) of Data Structure Sentinel, CWE-188 Reliance on Data/Memory Layout, CWE-198 Use of Incorrect Byte Ordering |
| Numeric | CWE-190 Integer Overflow or Wraparound, CWE-680 Integer Overflow to Buffer Overflow, CWE-192 Integer Coercion Error, CWE-195 Signed to Unsigned Conversion Error, CWE-197 Numeric Truncation Error, CWE-681 Incorrect Conversion between Numeric Types, CWE-704 Incorrect Type Conversion or Cast, CWE-468 Incorrect Pointer Scaling, CWE-1335 Incorrect Bitwise Shift of Integer |
| Authentication and credentials | Authentication Bypass by: CWE-289 Alternate Name, 294 Capture-replay, 302 Assumed-Immutable Data, 305 Primary Weakness. CWE-293 Using Referer Field for Authentication, CWE-303 Incorrect Implementation of Authentication Algorithm, CWE-304 Missing Critical Step in Authentication, CWE-603 Use of Client-Side Authentication, CWE-1390 Weak Authentication, CWE-1391 Use of Weak Credentials, CWE-522 Insufficiently Protected Credentials, CWE-523 Unprotected Transport of Credentials, CWE-1273 Device Unlock Credential Sharing |
| Authorisation and permissions | CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key, CWE-842 Placement of User into Incorrect Group, CWE-286 Incorrect User Management, CWE-283 Unverified Ownership, CWE-271 Privilege Dropping / Lowering Errors, CWE-273 Improper Check for Dropped Privileges, CWE-274 Improper Handling of Insufficient Privileges, Insecure Inherited (277), Insecure Preserved Inherited (278) and Incorrect Execution-Assigned (279) Permissions, CWE-281 Improper Preservation of Permissions, CWE-552 Files or Directories Accessible to External Parties, CWE-520 .NET Misconfiguration: Use of Impersonation, CWE-623 Unsafe ActiveX Control Marked Safe For Scripting, CWE-618 Exposed Unsafe ActiveX Method, CWE-1270 Generation of Incorrect Security Tokens, Incorrect Decoding (1290) and Conversion (1292) of Security Identifiers, CWE-1294 Insecure Security Identifier Mechanism |
| Cryptography and randomness | CWE-329 Generation of Predictable IV with CBC Mode, CWE-1204 Generation of Weak Initialization Vector (IV), CWE-330 Use of Insufficiently Random Values, CWE-338 Cryptographically Weak PRNG, Same Seed (336) and Predictable Seed (337) in PRNG, CWE-340 Generation of Predictable Numbers or Identifiers, Predictable Exact Value (342) and Value Range (343) from Previous Values, CWE-547 Use of Hard-coded, Security-relevant Constants. Cleartext Storage: CWE-314 in the Registry, 316 in Memory, 317 in GUI, 318 in Executable |
| Information exposure | Insertion of Sensitive Information Into Sent Data (201), Into Debugging Code (215), into Log File (532). Error Message Containing Sensitive Information: Externally-Generated (211), Servlet Runtime (536), Java Runtime (537). CWE-214 Invocation of Process Using Visible Sensitive Information, CWE-1295 Debug Messages Revealing Unnecessary Information, Observable Discrepancy (203), Response (204), Behavioral (205) and Timing (208) Discrepancy, Covert Timing (385) and Storage (515) Channel, Truncation (222) and Omission (223) of Security-relevant Information, CWE-922 Insecure Storage of Sensitive Information, CWE-591 Sensitive Data Storage in Improperly Locked Memory, CWE-1254 Incorrect Comparison Logic Granularity |
| Files, paths and links | CWE-41 Improper Resolution of Path Equivalence, CWE-58 Path Equivalence: Windows 8.3 Filename, CWE-40 Path Traversal: Windows UNC Share, CWE-61 UNIX Symbolic Link (Symlink) Following, CWE-62 UNIX Hard Link, CWE-64 Windows Shortcut Following (.LNK), CWE-363 Race Condition Enabling Link Following |
| Concurrency | CWE-362 Race Condition, CWE-367 Time-of-check Time-of-use (TOCTOU), CWE-412 Unrestricted Externally Accessible Lock, CWE-413 Improper Resource Locking, CWE-479 Signal Handler Use of a Non-reentrant Function, CWE-1223 Race Condition for Write-Once Attributes |
| Resources and initialisation | CWE-400 Uncontrolled Resource Consumption, CWE-407 Inefficient Algorithmic Complexity, CWE-1333 Inefficient Regular Expression Complexity, CWE-1176 Inefficient CPU Computation, CWE-410 Insufficient Resource Pool, CWE-408 Incorrect Behavior Order: Early Amplification, CWE-826 Premature Release of Resource During Expected Lifetime, CWE-459 Incomplete Cleanup, CWE-460 Improper Cleanup on Thrown Exception, CWE-453 Insecure Default Variable Initialization, Missing Initialization of a Variable (456), Use of Uninitialized Variable (457), Missing (909) and Incorrect (1419) Initialization of Resource, CWE-1229 Creation of Emergent Resource, CWE-920 Improper Restriction of Power Consumption, CWE-1239 Improper Zeroization of Hardware Register |
| Logic and coding practice | CWE-841 Improper Enforcement of Behavioral Workflow, CWE-372 Incomplete Internal State Distinction, CWE-471 Modification of Assumed-Immutable Data, CWE-829 Inclusion of Functionality from Untrusted Control Sphere, CWE-419 Unprotected Primary Channel, CWE-656 Reliance on Security Through Obscurity, CWE-489 Active Debug Code, CWE-487 Reliance on Package-level Scope, CWE-1066 Missing Serialization Control Element, CWE-242 Use of Inherently Dangerous Function, CWE-477 Use of Obsolete Function, CWE-480 Use of Incorrect Operator, CWE-483 Incorrect Block Delimitation, CWE-484 Omitted Break Statement in Switch |
Other CWE entries tracked (names only, IDs not verified here): Compiler Removal of Code to Clear Buffers; External Control of System or Configuration Setting; Improper Use of Validation Framework; Struts weaknesses (Duplicate Validation Forms, Incomplete validate() Method Definition, Form Field Without Validator, Unused Validation Form, Unvalidated Action Form, Validator Turned Off); ASP.NET Misconfiguration (Creating Debug Binary, Improper Model Validation); Direct Use of Unsafe JNI; Missing XML Validation; Insecure Automated Optimizations; Insufficient Encapsulation; Comparison of Incompatible Types; Incomplete Comparison with Missing Factors; Permissive List of Allowed Inputs; regular expression weaknesses (Incorrect, Overly Restrictive, Permissive, Without Anchors, Executable Regular Expression Error); Execution with Unnecessary Privileges; Unchecked Return Value; Unchecked Error Condition; Uncaught Exception (including in Servlet); Improper Handling of Exceptional Conditions; Missing Standardized Error Handling Mechanism; Reachable Assertion; Uncontrolled Recursion; Unchecked Input for Loop Condition; Incorrect Short Circuit Evaluation; Assigning instead of Comparing; Insufficient Verification of Data Authenticity; Insufficient Type Distinction; Insecure Temporary File; Creation of Temporary File With Insecure Permissions; File Descriptor Leak; Use of Expired File Descriptor; Unquoted Search Path or Element; Command Shell in Externally Accessible Directory; Binding to an Unrestricted IP Address; Deployment of Wrong Handler; Unparsed Raw Web Content Delivery; UI Discrepancy for Security Feature; User Interface Misrepresentation of Critical Information; Non-exit on Failed Initialization; Object Hijack; Cloneable Class Containing Sensitive Information; Serializable Class Containing Sensitive Data; Variable Extraction Error; Improper Control of Dynamically-Identified Variables; Not Using Complete Mediation; Reliance on Insufficiently Trustworthy Component; Non-Transparent Sharing of Microarchitectural Resources; hardware entries (Failure to Disable Reserved Bits, Mirrored Regions with Different Values, Incorrect Selection of Fuse Values, Product Released in Non-Release Configuration, Firmware Not Updateable, Improper Protections Against Hardware Overheating). Related CAPEC patterns: Format String Injection, Explore for Predictable Temporary File Names, Leveraging Race Conditions (including via Symbolic Links), Regular Expression Exponential Blowup, Overread Buffers, Exploitation of Improperly Controlled Registers, Forced Integer Overflow. "File system permissions weakness" is an ATT&CK label, not a CWE.
Detection and measurement
- Log: a CWE ID and source rule on every SAST, DAST, pen test, bug bounty and incident finding.
- Recurrence rate: new findings per targeted CWE per quarter, per product.
- Coverage: share of Top 25 and KEV-list entries with a blocking rule and a test.
- Time to remediate Top 25 and KEV-list findings.
- Mapping quality: share of findings mapped to a Base or Variant.
- Memory-safe share of new code; supplier advisories with CWE fields.
Framework mapping
| Framework | Where Top 25 work sits |
|---|---|
| NIST CSF 2.0 | PR.PS-06 secure software development; ID.RA-01 vulnerabilities identified |
| NIST SP 800-53 Rev 5 | SA-8, SA-11, SA-15, SI-10 input validation, SI-16 memory protection, RA-5 |
| NIST SP 800-218 (SSDF) | PW.5, PW.7, PW.8, RV.3 root cause analysis |
| CIS Controls v8.1 | Control 16: 16.6 severity rating, 16.9 developer training, 16.12 code-level security checks |
| ISO/IEC 27001:2022 | A.8.8, A.8.25, A.8.28 secure coding, A.8.29 |
| PCI DSS v4.0 | Requirement 6.2.4 (bespoke code attacks). See the PCI DSS 4.0 Guide. |
Common failure patterns
- Closing instances, not classes. Fixing CWE-89 findings while string-built queries stay legal guarantees recurrence. See the McKinsey Lilli incident: SQL injection in unauthenticated APIs.
- Mapping to broad entries. Labelling everything CWE-20 or CWE-284 hides the real class.
- Patching without rotating what leaked. In ToolShell, stolen ASP.NET machine keys kept attackers inside after patching. Rotate secrets any CWE-502 or memory disclosure flaw could have exposed.
- Underrating SSRF. The Capital One breach turned CWE-918 into cloud role credential theft.
- Testing chained weaknesses separately. Ivanti Connect Secure attackers chained authentication bypass with command injection.
Practitioner checklist
- Map 12 months of findings to Base or Variant CWEs and pick three to five target classes.
- Write one coding standard control per targeted CWE.
- Make Top 25 and KEV-list SAST rules blocking after a report-only pilot.
- Ship safe defaults: bound parameters, auto-escaping templates, central authorisation, upload validation.
- Set a memory safety roadmap; fuzz what remains.
- Require CWE fields in supplier advisories.
- Rotate credentials after any flaw that could expose memory or files.
Standards and references
- MITRE CWE: 2025 CWE Top 25 Most Dangerous Software Weaknesses
- MITRE CWE: 2025 CWE Top 25 Methodology
- MITRE CWE: 2025 CWE Top 10 KEV Weaknesses
- MITRE CWE: Root Cause Mapping Guidance
- MITRE CWE: Glossary
- MITRE CAPEC: CAPEC-100 Overflow Buffers
- OWASP: Top 10:2025 Introduction
- CISA: Secure by Design Pledge
Related NHI Mgmt Group resources: Vulnerability Management Guide · Zero-Day and Exploited Vulnerabilities Guide · Open Source Security Guide · SLSA and Build Provenance Guide · MFA Guide