2025 CWE Top 10 KEV Weaknesses

Share via:

1. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
   CWE-78 CVEs in KEV: 20 Rank Last Year: 3 (up 2)
2. Use After Free
   CWE-416 CVEs in KEV: 14 Rank Last Year: 9 (up 7)
3. Out-of-bounds Write
   CWE-787 CVEs in KEV: 12 Rank Last Year: 1 (down 2)
4. Missing Authentication for Critical Function
   CWE-306 CVEs in KEV: 11 Rank Last Year: 7 (up 3)
5. Deserialization of Untrusted Data
   CWE-502 CVEs in KEV: 11 Rank Last Year: 5
6. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
   CWE-22 CVEs in KEV: 10 Rank Last Year: 6
7. Improper Control of Generation of Code ('Code Injection')
   CWE-94 CVEs in KEV: 7 Rank Last Year: 4 (down 3)
8. Authentication Bypass Using an Alternate Path or Channel
   CWE-288 CVEs in KEV: 6 Rank Last Year: 14 (up 6)
9. Heap-based Buffer Overflow
   CWE-122 CVEs in KEV: 6 Rank Last Year: 11 (up 2)
10. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    CWE-79 CVEs in KEV: 7 Rank Last Year: 21 (up 11)