| CWE-693 | Protection Mechanism Failure | 885 | 14 | 0 |
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | 402 | 0 | 1 |
| CWE-16 | Configuration | 297 | 0 | 1 |
| CWE-1188 | Initialization of a Resource with an Insecure Default | 286 | 4 | 7 |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | 122 | 0 | 2 |
| CWE-489 | Active Debug Code | 100 | 0 | 2 |
| CWE-15 | External Control of System or Configuration Setting | 93 | 0 | 1 |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | 66 | 0 | 0 |
| CWE-636 | Not Failing Securely | 64 | 0 | 0 |
| CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | 35 | 0 | 1 |
| CWE-453 | Insecure Default Variable Initialization | 22 | 0 | 0 |
| CWE-657 | Violation of Secure Design Principles | 21 | 0 | 0 |
| CWE-477 | Use of Obsolete Function | 15 | – | – |
| CWE-1022 | Use of Web Link to Untrusted Target with window.opener Access | 14 | – | – |
| CWE-14 | Compiler Removal of Code to Clear Buffers | 10 | – | – |
| CWE-656 | Reliance on Security Through Obscurity | 10 | – | – |
| CWE-676 | Use of Potentially Dangerous Function | 10 | – | – |
| CWE-1173 | Improper Use of Validation Framework | 9 | – | – |
| CWE-671 | Lack of Administrator Control over Security | 6 | – | – |
| CWE-454 | External Initialization of Trusted Variables or Data Stores | 4 | – | – |
| CWE-447 | Unimplemented or Unsupported Feature in UI | 3 | – | – |
| CWE-1059 | Insufficient Technical Documentation | 3 | – | – |
| CWE-5 | J2EE Misconfiguration: Data Transmission Without Encryption | 2 | – | – |
| CWE-6 | J2EE Misconfiguration: Insufficient Session-ID Length | 2 | – | – |
| CWE-11 | ASP.NET Misconfiguration: Creating Debug Binary | 2 | – | – |
| CWE-455 | Non-exit on Failed Initialization | 2 | – | – |
| CWE-1112 | Incomplete Documentation of Program Execution | 2 | – | – |
| CWE-12 | ASP.NET Misconfiguration: Missing Custom Error Page | 1 | – | – |
| CWE-102 | Struts: Duplicate Validation Forms | 1 | – | – |
| CWE-637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') | 1 | – | – |
| CWE-638 | Not Using Complete Mediation | 1 | – | – |
| CWE-655 | Insufficient Psychological Acceptability | 1 | – | – |
| CWE-1118 | Insufficient Documentation of Error Handling Techniques | 1 | – | – |
| CWE-1174 | ASP.NET Misconfiguration: Improper Model Validation | 1 | – | – |