CWE -
2025 CWE Top 25 Most Dangerous Software Weaknesses

	
	
	
	
	
	 Common Weakness Enumeration

	 Celebrating 20 years of community-developed cybersecurity weakness knowledge!

	
	

	

	

	

	

	
		
Home > CWE Top 25 >

2025 
			
		 
		

	ID Lookup:

	


			
	












Home



About &#x25BC; 

Who We Are 
User Stories 
History 
Documents 
Videos 








Learn &#x25BC; 

Basics 

Root Cause Mapping &#x25BA; 

Guidance 
Quick Tips 
Examples 




How to Contribute Weakness Content 
FAQs 
Glossary 








Access Content &#x25BC; 


Top-N Lists &#x25BA; 

Top 25 Software 
Top Hardware 
Top 10 KEV Weaknesses 





CWE List &#x25BA; 

Current Version 
Reports 
Visualizations 
Releases Archive 




Downloads 
REST API 








Community &#x25BC; 


News &#x25BA; 

Current News 
Blog 
Podcast 
News Archive 




CWE Board 
Working Groups & Special Interest Groups 
Email Lists 








Search &#x25BC; 

Search CWE List 
Search Website 












	 

	 
	 
		
	 
	
	 
	 


		
	 



	 

	
	 
	



CWE Glossary Definition
	
	





	








2025 CWE Top 25 Most Dangerous Software Weaknesses


Top 25 Home

Share via: 
View in table format

Key Insights

Methodology







2025 CWE Top 25

&times; 




Rank	
ID	
Name	 Score	
CVEs in KEV	
Rank Change vs. 2024	




1 	
CWE-79 	
Improper Neutralization of Input During Web Page Generation (&#x27;Cross-site Scripting&#x27;)	
60.38	
7	
0	




2 	
CWE-89 	
Improper Neutralization of Special Elements used in an SQL Command (&#x27;SQL Injection&#x27;)	
28.72	
4	
+1	




3 	
CWE-352 	
Cross-Site Request Forgery (CSRF)	
13.64	
0	
+1	




4 	
CWE-862 	
Missing Authorization	
13.28	
0	
+5	




5 	
CWE-787 	
Out-of-bounds Write	
12.68	
12	
-3	




6 	
CWE-22 	
Improper Limitation of a Pathname to a Restricted Directory (&#x27;Path Traversal&#x27;)	
8.99	
10	
-1	




7 	
CWE-416 	
Use After Free	
8.47	
14	
+1	




8 	
CWE-125 	
Out-of-bounds Read	
7.88	
3	
-2	




9 	
CWE-78 	
Improper Neutralization of Special Elements used in an OS Command (&#x27;OS Command Injection&#x27;)	
7.85	
20	
-2	




10 	
CWE-94 	
Improper Control of Generation of Code (&#x27;Code Injection&#x27;)	
7.57	
7	
+1	




11 	
CWE-120 	
Buffer Copy without Checking Size of Input (&#x27;Classic Buffer Overflow&#x27;)	
6.96	
0	
N/A	




12 	
CWE-434 	
Unrestricted Upload of File with Dangerous Type	
6.87	
4	
-2	




13 	
CWE-476 	
NULL Pointer Dereference	
6.41	
0	
+8	




14 	
CWE-121 	
Stack-based Buffer Overflow	
5.75	
4	
N/A	




15 	
CWE-502 	
Deserialization of Untrusted Data	
5.23	
11	
+1	




16 	
CWE-122 	
Heap-based Buffer Overflow	
5.21	
6	
N/A	




17 	
CWE-863 	
Incorrect Authorization	
4.14	
4	
+1	




18 	
CWE-20 	
Improper Input Validation	
4.09	
2	
-6	




19 	
CWE-284 	
Improper Access Control	
4.07	
1	
N/A	




20 	
CWE-200 	
Exposure of Sensitive Information to an Unauthorized Actor	
4.01	
1	
-3	




21 	
CWE-306 	
Missing Authentication for Critical Function	
3.47	
11	
+4	




22 	
CWE-918 	
Server-Side Request Forgery (SSRF)	
3.36	
0	
-3	




23 	
CWE-77 	
Improper Neutralization of Special Elements used in a Command (&#x27;Command Injection&#x27;)	
3.15	
2	
-10	




24 	
CWE-639 	
Authorization Bypass Through User-Controlled Key	
2.62	
0	
+6	




25 	
CWE-770 	
Allocation of Resources Without Limits or Throttling	
2.54	
0	
+1	














Improper Neutralization of Input During Web Page Generation (&#x27;Cross-site Scripting&#x27;) 


CWE-79 
CVEs in KEV: 7 
Rank Last Year: 1 







Improper Neutralization of Special Elements used in an SQL Command (&#x27;SQL Injection&#x27;) 


CWE-89 
CVEs in KEV: 4 
Rank Last Year: 3 (up 1) 







Cross-Site Request Forgery (CSRF) 


CWE-352 
CVEs in KEV: 0 
Rank Last Year: 4 (up 1) 







Missing Authorization 


CWE-862 
CVEs in KEV: 0 
Rank Last Year: 9 (up 5) 







Out-of-bounds Write 


CWE-787 
CVEs in KEV: 12 
Rank Last Year: 2 (down 3) 







Improper Limitation of a Pathname to a Restricted Directory (&#x27;Path Traversal&#x27;) 


CWE-22 
CVEs in KEV: 10 
Rank Last Year: 5 (down 1) 







Use After Free 


CWE-416 
CVEs in KEV: 14 
Rank Last Year: 8 (up 1) 







Out-of-bounds Read 


CWE-125 
CVEs in KEV: 3 
Rank Last Year: 6 (down 2) 







Improper Neutralization of Special Elements used in an OS Command (&#x27;OS Command Injection&#x27;) 


CWE-78 
CVEs in KEV: 20 
Rank Last Year: 7 (down 2) 







Improper Control of Generation of Code (&#x27;Code Injection&#x27;) 


CWE-94 
CVEs in KEV: 7 
Rank Last Year: 11 (up 1) 







Buffer Copy without Checking Size of Input (&#x27;Classic Buffer Overflow&#x27;) 


CWE-120 
CVEs in KEV: 0 
Rank Last Year: N/A 







Unrestricted Upload of File with Dangerous Type 


CWE-434 
CVEs in KEV: 4 
Rank Last Year: 10 (down 2) 







NULL Pointer Dereference 


CWE-476 
CVEs in KEV: 0 
Rank Last Year: 21 (up 8) 







Stack-based Buffer Overflow 


CWE-121 
CVEs in KEV: 4 
Rank Last Year: N/A 







Deserialization of Untrusted Data 


CWE-502 
CVEs in KEV: 11 
Rank Last Year: 16 (up 1) 







Heap-based Buffer Overflow 


CWE-122 
CVEs in KEV: 6 
Rank Last Year: N/A 







Incorrect Authorization 


CWE-863 
CVEs in KEV: 4 
Rank Last Year: 18 (up 1) 







Improper Input Validation 


CWE-20 
CVEs in KEV: 2 
Rank Last Year: 12 (down 6) 







Improper Access Control 


CWE-284 
CVEs in KEV: 1 
Rank Last Year: N/A 







Exposure of Sensitive Information to an Unauthorized Actor 


CWE-200 
CVEs in KEV: 1 
Rank Last Year: 17 (down 3) 







Missing Authentication for Critical Function 


CWE-306 
CVEs in KEV: 11 
Rank Last Year: 25 (up 4) 







Server-Side Request Forgery (SSRF) 


CWE-918 
CVEs in KEV: 0 
Rank Last Year: 19 (down 3) 







Improper Neutralization of Special Elements used in a Command (&#x27;Command Injection&#x27;) 


CWE-77 
CVEs in KEV: 2 
Rank Last Year: 13 (down 10) 







Authorization Bypass Through User-Controlled Key 


CWE-639 
CVEs in KEV: 0 
Rank Last Year: 30 (up 6) 







Allocation of Resources Without Limits or Throttling 


CWE-770 
CVEs in KEV: 0 
Rank Last Year: 26 (up 1) 






Back to top





		
	 






Page Last Updated: 

December 15, 2025

	

	

Site Map |
Terms of Use |
Manage Cookies |
Cookie Notice |
Privacy Policy |
Contact Us |

			

Use of the Common Weakness Enumeration (CWE&trade;) and the associated references from this website are subject to the Terms of Use . CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright &copy; 2006&ndash;2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.