| CWE-200 | Information Exposure | 11,425 | 18 | 162 |
| CWE-532 | Sensitive Data in Logs | 1,221 | 2 | 8 |
| CWE-203 | Observable Discrepancy | 689 | 1 | 11 |
| CWE-209 | Generation of Error Message Containing Sensitive Information | 632 | 3 | 5 |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | 501 | 0 | 13 |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 453 | 1 | 4 |
| CWE-922 | Insecure Storage of Sensitive Information | 311 | 0 | 1 |
| CWE-204 | Observable Response Discrepancy | 217 | 0 | 5 |
| CWE-208 | Observable Timing Discrepancy | 210 | 0 | 1 |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 208 | 0 | 8 |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | 109 | 0 | 0 |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | 107 | 0 | 2 |
| CWE-598 | Use of HTTP Request With Sensitive Query String | 99 | – | – |
| CWE-524 | Use of Cache Containing Sensitive Information | 82 | – | – |
| CWE-548 | Exposure of Information Through Directory Listing | 65 | – | – |
| CWE-488 | Exposure of Data Element to Wrong Session | 55 | – | – |
| CWE-202 | Exposure of Sensitive Information Through Data Queries | 44 | – | – |
| CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | 41 | – | – |
| CWE-214 | Invocation of Process Using Visible Sensitive Information | 40 | – | – |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | 37 | – | – |
| CWE-540 | Inclusion of Sensitive Information in Source Code | 36 | – | – |
| CWE-1300 | Improper Protection of Physical Side Channels | 36 | – | – |
| CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | 34 | – | – |
| CWE-215 | Insertion of Sensitive Information Into Debugging Code | 27 | – | – |
| CWE-1230 | Exposure of Sensitive Information Through Metadata | 26 | – | – |
| CWE-526 | Cleartext Storage of Sensitive Information in an Environment Variable | 23 | – | – |
| CWE-1295 | Debug Messages Revealing Unnecessary Information | 22 | – | – |
| CWE-1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information | 16 | – | – |
| CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | 14 | – | – |
| CWE-612 | Improper Authorization of Index Containing Sensitive Information | 9 | – | – |
| CWE-921 | Storage of Sensitive Data in a Mechanism without Access Control | 8 | – | – |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | 7 | – | – |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | 6 | – | – |
| CWE-1254 | Incorrect Comparison Logic Granularity | 6 | – | – |
| CWE-550 | Server-generated Error Message Containing Sensitive Information | 5 | – | – |
| CWE-1303 | Non-Transparent Sharing of Microarchitectural Resources | 5 | – | – |
| CWE-210 | Self-generated Error Message Containing Sensitive Information | 4 | – | – |
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | 4 | – | – |
| CWE-534 | CWE-534 | 4 | – | – |
| CWE-205 | Observable Behavioral Discrepancy | 3 | – | – |
| CWE-531 | Inclusion of Sensitive Information in Test Code | 3 | – | – |
| CWE-535 | Exposure of Information Through Shell Error Message | 3 | – | – |
| CWE-615 | Inclusion of Sensitive Information in Source Code Comments | 3 | – | – |
| CWE-1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks | 3 | – | – |
| CWE-1342 | Information Exposure through Microarchitectural State after Transient Execution | 3 | – | – |
| CWE-528 | Exposure of Core Dump File to an Unauthorized Control Sphere | 2 | – | – |
| CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition | 2 | – | – |
| CWE-1301 | Insufficient or Incomplete Data Removal within Hardware Component | 2 | – | – |
| CWE-207 | Observable Behavioral Discrepancy With Equivalent Products | 1 | – | – |
| CWE-433 | Unparsed Raw Web Content Delivery | 1 | – | – |
| CWE-529 | Exposure of Access Control List Files to an Unauthorized Control Sphere | 1 | – | – |
| CWE-533 | CWE-533 | 1 | – | – |
| CWE-541 | Inclusion of Sensitive Information in an Include File | 1 | – | – |
| CWE-1330 | Remanent Data Readable after Memory Erase | 1 | – | – |