| CWE-310 | Cryptographic Issues | 2,283 | 0 | 1 |
| CWE-295 | Improper Certificate Validation | 1,654 | 5 | 0 |
| CWE-347 | Improper Verification of Cryptographic Signature | 912 | 7 | 4 |
| CWE-319 | Cleartext Transmission of Sensitive Information | 881 | 0 | 3 |
| CWE-312 | Cleartext Storage of Sensitive Information | 771 | 2 | 4 |
| CWE-345 | Insufficient Verification of Data Authenticity | 730 | 1 | 2 |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 614 | 0 | 2 |
| CWE-311 | Missing Encryption of Sensitive Data | 461 | 1 | 1 |
| CWE-321 | Use of Hard-coded Cryptographic Key | 436 | 2 | 4 |
| CWE-326 | Inadequate Encryption Strength | 407 | 4 | 0 |
| CWE-330 | Use of Insufficiently Random Values | 330 | 0 | 0 |
| CWE-354 | Improper Validation of Integrity Check Value | 197 | 0 | 1 |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | 190 | – | – |
| CWE-331 | Insufficient Entropy | 128 | – | – |
| CWE-358 | Improperly Implemented Security Check for Standard | 128 | – | – |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | 127 | – | – |
| CWE-297 | Improper Validation of Certificate with Host Mismatch | 101 | – | – |
| CWE-348 | Use of Less Trusted Source | 100 | – | – |
| CWE-328 | Use of Weak Hash | 90 | – | – |
| CWE-340 | Generation of Predictable Numbers or Identifiers | 64 | – | – |
| CWE-325 | Missing Cryptographic Step | 63 | – | – |
| CWE-300 | Channel Accessible by Non-Endpoint | 54 | – | – |
| CWE-353 | Missing Support for Integrity Check | 51 | – | – |
| CWE-323 | Reusing a Nonce, Key Pair in Encryption | 48 | – | – |
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | 48 | – | – |
| CWE-316 | Cleartext Storage of Sensitive Information in Memory | 42 | – | – |
| CWE-320 | Key Management Errors | 40 | – | – |
| CWE-335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) | 35 | – | – |
| CWE-924 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | 35 | – | – |
| CWE-322 | Key Exchange without Entity Authentication | 33 | – | – |
| CWE-313 | Cleartext Storage in a File or on Disk | 32 | – | – |
| CWE-299 | Improper Check for Certificate Revocation | 24 | – | – |
| CWE-324 | Use of a Key Past its Expiration Date | 23 | – | – |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | 21 | – | – |
| CWE-296 | Improper Following of a Certificate's Chain of Trust | 19 | – | – |
| CWE-759 | Use of a One-Way Hash without a Salt | 19 | – | – |
| CWE-329 | Generation of Predictable IV with CBC Mode | 17 | – | – |
| CWE-337 | Predictable Seed in Pseudo-Random Number Generator (PRNG) | 17 | – | – |
| CWE-341 | Predictable from Observable State | 15 | – | – |
| CWE-334 | Small Space of Random Values | 14 | – | – |
| CWE-351 | Insufficient Type Distinction | 13 | – | – |
| CWE-599 | Missing Validation of OpenSSL Certificate | 13 | – | – |
| CWE-332 | Insufficient Entropy in PRNG | 11 | – | – |
| CWE-760 | Use of a One-Way Hash with a Predictable Salt | 11 | – | – |
| CWE-649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking | 9 | – | – |
| CWE-1241 | Use of Predictable Algorithm in Random Number Generator | 9 | – | – |
| CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | 8 | – | – |
| CWE-616 | Incomplete Identification of Uploaded File Variables (PHP) | 8 | – | – |
| CWE-298 | Improper Validation of Certificate Expiration | 7 | – | – |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | 7 | – | – |
| CWE-342 | Predictable Exact Value from Previous Values | 7 | – | – |
| CWE-1428 | Reliance on HTTP instead of HTTPS | 5 | – | – |
| CWE-343 | Predictable Value Range from Previous Values | 4 | – | – |
| CWE-1204 | Generation of Weak Initialization Vector (IV) | 4 | – | – |
| CWE-336 | Same Seed in Pseudo-Random Number Generator (PRNG) | 3 | – | – |
| CWE-344 | Use of Invariant Value in Dynamically Changing Context | 3 | – | – |
| CWE-780 | Use of RSA Algorithm without OAEP | 3 | – | – |
| CWE-360 | Trust of System Event Data | 2 | – | – |
| CWE-314 | Cleartext Storage in the Registry | 1 | – | – |
| CWE-318 | Cleartext Storage of Sensitive Information in Executable | 1 | – | – |
| CWE-333 | Improper Handling of Insufficient Entropy in TRNG | 1 | – | – |
| CWE-339 | Small Seed Space in PRNG | 1 | – | – |
| CWE-587 | Assignment of a Fixed Address to a Pointer | 1 | – | – |