| CWE-862 | Missing Authorization | 11,120 | 11 | 123 |
| CWE-284 | Improper Access Control | 7,485 | 34 | 32 |
| CWE-264 | Permissions, Privileges, and Access Controls | 5,337 | 2 | 7 |
| CWE-863 | Incorrect Authorization | 4,226 | 20 | 35 |
| CWE-269 | Improper Privilege Management | 3,429 | 20 | 23 |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,585 | 3 | 7 |
| CWE-276 | Incorrect Default Permissions | 1,478 | 3 | 5 |
| CWE-266 | Incorrect Privilege Assignment | 1,273 | 1 | 8 |
| CWE-285 | Improper Authorization | 1,133 | 1 | 9 |
| CWE-346 | Origin Validation Error | 781 | 2 | 3 |
| CWE-668 | Exposure of Resource to Wrong Sphere | 500 | 0 | 7 |
| CWE-250 | Execution with Unnecessary Privileges | 369 | 0 | 0 |
| CWE-281 | Improper Preservation of Permissions | 327 | – | – |
| CWE-425 | Direct Request | 218 | – | – |
| CWE-441 | Unintended Proxy or Intermediary | 205 | – | – |
| CWE-280 | Improper Handling of Insufficient Permissions or Privileges | 204 | – | – |
| CWE-749 | Exposed Dangerous Method or Function | 199 | – | – |
| CWE-926 | Improper Export of Android Application Components | 152 | – | – |
| CWE-1220 | Insufficient Granularity of Access Control | 122 | – | – |
| CWE-669 | Incorrect Resource Transfer Between Spheres | 112 | – | – |
| CWE-275 | Permission Issues | 99 | – | – |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | 81 | – | – |
| CWE-653 | Improper Isolation or Compartmentalization | 74 | – | – |
| CWE-267 | Privilege Defined With Unsafe Actions | 73 | – | – |
| CWE-648 | Incorrect Use of Privileged APIs | 71 | – | – |
| CWE-277 | Insecure Inherited Permissions | 70 | – | – |
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | 66 | – | – |
| CWE-940 | Improper Verification of Source of a Communication Channel | 66 | – | – |
| CWE-927 | Use of Implicit Intent for Sensitive Communication | 57 | – | – |
| CWE-424 | Improper Protection of Alternate Path | 54 | – | – |
| CWE-782 | Exposed IOCTL with Insufficient Access Control | 51 | – | – |
| CWE-273 | Improper Check for Dropped Privileges | 46 | – | – |
| CWE-1385 | Missing Origin Validation in WebSockets | 45 | – | – |
| CWE-272 | Least Privilege Violation | 43 | – | – |
| CWE-420 | Unprotected Alternate Channel | 41 | – | – |
| CWE-274 | Improper Handling of Insufficient Privileges | 38 | – | – |
| CWE-283 | Unverified Ownership | 36 | – | – |
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | 36 | – | – |
| CWE-356 | Missing User Interaction for Potentially Unsafe Action | 34 | – | – |
| CWE-1327 | Binding to an Unrestricted IP Address | 33 | – | – |
| CWE-286 | Incorrect User Management | 32 | – | – |
| CWE-282 | Improper Ownership Management | 31 | – | – |
| CWE-279 | Incorrect Execution-Assigned Permissions | 25 | – | – |
| CWE-270 | Privilege Context Switching Error | 24 | – | – |
| CWE-268 | Privilege Chaining | 21 | – | – |
| CWE-642 | External Control of Critical State Data | 20 | – | – |
| CWE-804 | Guessable CAPTCHA | 19 | – | – |
| CWE-925 | Improper Verification of Intent by Broadcast Receiver | 19 | – | – |
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | 18 | – | – |
| CWE-265 | Privilege Issues | 15 | – | – |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | 13 | – | – |
| CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State | 13 | – | – |
| CWE-271 | Privilege Dropping / Lowering Errors | 11 | – | – |
| CWE-1262 | Improper Access Control for Register Interface | 11 | – | – |
| CWE-842 | Placement of User into Incorrect Group | 10 | – | – |
| CWE-941 | Incorrectly Specified Destination in a Communication Channel | 9 | – | – |
| CWE-419 | Unprotected Primary Channel | 8 | – | – |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | 8 | – | – |
| CWE-278 | Insecure Preserved Inherited Permissions | 7 | – | – |
| CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) | 7 | – | – |
| CWE-1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution | 7 | – | – |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | 6 | – | – |
| CWE-1328 | Security Version Number Mutable to Older Versions | 6 | – | – |
| CWE-520 | .NET Misconfiguration: Use of Impersonation | 5 | – | – |
| CWE-1420 | Exposure of Sensitive Information during Transient Execution | 5 | – | – |
| CWE-1421 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution | 5 | – | – |
| CWE-491 | Public cloneable() Method Without Final | 4 | – | – |
| CWE-767 | Access to Critical Private Variable via Public Method | 4 | – | – |
| CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | 3 | – | – |
| CWE-422 | Unprotected Windows Messaging Channel | 2 | – | – |
| CWE-1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution | 2 | – | – |
| CWE-374 | Passing Mutable Objects to an Untrusted Method | 1 | – | – |
| CWE-495 | Private Data Structure Returned From A Public Method | 1 | – | – |
| CWE-499 | Serializable Class Containing Sensitive Data | 1 | – | – |
| CWE-556 | ASP.NET Misconfiguration: Use of Identity Impersonation | 1 | – | – |
| CWE-618 | Exposed Unsafe ActiveX Method | 1 | – | – |
| CWE-1222 | Insufficient Granularity of Address Regions Protected by Register Locks | 1 | – | – |
| CWE-1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents | 1 | – | – |
| CWE-1314 | Missing Write Protection for Parametric Data Values | 1 | – | – |