| CWE-611 | XML External Entity | 1,363 | 9 | 27 |
| CWE-74 | Injection | 1,090 | 13 | 28 |
| CWE-444 | Inconsistent Interpretation of HTTP Requests | 441 | 4 | 2 |
| CWE-116 | Improper Encoding or Escaping of Output | 389 | 4 | 5 |
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | 323 | 0 | 0 |
| CWE-93 | Improper Neutralization of CRLF Sequences | 265 | 0 | 5 |
| CWE-91 | XML Injection | 146 | 1 | 3 |
| CWE-117 | Improper Output Neutralization for Logs | 140 | 0 | 0 |
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers | 128 | 0 | 2 |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query | 108 | 0 | 0 |
| CWE-99 | Improper Control of Resource Identifiers | 74 | 0 | 0 |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | 69 | 0 | 0 |
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | 61 | – | – |
| CWE-176 | Improper Handling of Unicode Encoding | 39 | – | – |
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | 37 | – | – |
| CWE-75 | Failure to Sanitize Special Elements into a Different Plane | 33 | – | – |
| CWE-1427 | Improper Neutralization of Input Used for LLM Prompting | 26 | – | – |
| CWE-172 | Improper Encoding or Decoding of Data | 22 | – | – |
| CWE-140 | Improper Neutralization of Delimiters | 21 | – | – |
| CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | 19 | – | – |
| CWE-643 | Improper Neutralization of Data within XPath Expressions | 18 | – | – |
| CWE-155 | Improper Neutralization of Wildcards or Matching Symbols | 17 | – | – |
| CWE-694 | Use of Multiple Resources with Duplicate Identifier | 17 | – | – |
| CWE-791 | Incomplete Filtering of Special Elements | 17 | – | – |
| CWE-76 | Improper Neutralization of Equivalent Special Elements | 15 | – | – |
| CWE-138 | Improper Neutralization of Special Elements | 15 | – | – |
| CWE-790 | Improper Filtering of Special Elements | 14 | – | – |
| CWE-159 | Improper Handling of Invalid Use of Special Elements | 12 | – | – |
| CWE-141 | Improper Neutralization of Parameter/Argument Delimiters | 11 | – | – |
| CWE-146 | Improper Neutralization of Expression/Command Delimiters | 10 | – | – |
| CWE-173 | Improper Handling of Alternate Encoding | 8 | – | – |
| CWE-174 | Double Decoding of the Same Data | 8 | – | – |
| CWE-112 | Missing XML Validation | 7 | – | – |
| CWE-179 | Incorrect Behavior Order: Early Validation | 7 | – | – |
| CWE-149 | Improper Neutralization of Quoting Syntax | 6 | – | – |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | 6 | – | – |
| CWE-153 | Improper Neutralization of Substitution Characters | 5 | – | – |
| CWE-156 | Improper Neutralization of Whitespace | 5 | – | – |
| CWE-167 | Improper Handling of Additional Special Element | 5 | – | – |
| CWE-794 | Incomplete Filtering of Multiple Instances of Special Elements | 5 | – | – |
| CWE-147 | Improper Neutralization of Input Terminators | 4 | – | – |
| CWE-166 | Improper Handling of Missing Special Element | 4 | – | – |
| CWE-792 | Incomplete Filtering of One or More Instances of Special Elements | 4 | – | – |
| CWE-142 | Improper Neutralization of Value Delimiters | 3 | – | – |
| CWE-144 | Improper Neutralization of Line Delimiters | 3 | – | – |
| CWE-164 | Improper Neutralization of Internal Special Elements | 3 | – | – |
| CWE-143 | Improper Neutralization of Record Delimiters | 2 | – | – |
| CWE-148 | Improper Neutralization of Input Leaders | 2 | – | – |
| CWE-168 | Improper Handling of Inconsistent Special Elements | 2 | – | – |
| CWE-652 | Improper Neutralization of Data within XQuery Expressions | 2 | – | – |
| CWE-145 | Improper Neutralization of Section Delimiters | 1 | – | – |
| CWE-154 | Improper Neutralization of Variable Name Delimiters | 1 | – | – |
| CWE-160 | Improper Neutralization of Leading Special Elements | 1 | – | – |
| CWE-162 | Improper Neutralization of Trailing Special Elements | 1 | – | – |
| CWE-175 | Improper Handling of Mixed Encoding | 1 | – | – |
| CWE-462 | Duplicate Key in Associative List (Alist) | 1 | – | – |
| CWE-797 | Only Filtering Special Elements at an Absolute Position | 1 | – | – |
| CWE-827 | Improper Control of Document Type Definition | 1 | – | – |