| CWE-20 | Improper Input Validation | 12,139 | 63 | 50 |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | 603 | 4 | 0 |
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | 496 | 2 | 1 |
| CWE-755 | Improper Handling of Exceptional Conditions | 441 | 3 | 0 |
| CWE-248 | Uncaught Exception | 369 | 0 | 0 |
| CWE-1284 | Improper Validation of Specified Quantity in Input | 366 | 1 | 2 |
| CWE-184 | Incomplete List of Disallowed Inputs | 216 | 1 | 0 |
| CWE-252 | Unchecked Return Value | 182 | 0 | 0 |
| CWE-602 | Client-Side Enforcement of Server-Side Security | 173 | 0 | 0 |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | 167 | 1 | 0 |
| CWE-1287 | Improper Validation of Specified Type of Input | 162 | 1 | 0 |
| CWE-436 | Interpretation Conflict | 157 | 2 | 0 |
| CWE-703 | Improper Check or Handling of Exceptional Conditions | 152 | – | – |
| CWE-670 | Always-Incorrect Control Flow Implementation | 148 | – | – |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | 147 | – | – |
| CWE-682 | Incorrect Calculation | 137 | – | – |
| CWE-178 | Improper Handling of Case Sensitivity | 135 | – | – |
| CWE-697 | Incorrect Comparison | 125 | – | – |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | 111 | – | – |
| CWE-840 | Business Logic Errors | 98 | – | – |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | 94 | – | – |
| CWE-841 | Improper Enforcement of Behavioral Workflow | 84 | – | – |
| CWE-799 | Improper Control of Interaction Frequency | 63 | – | – |
| CWE-696 | Incorrect Behavior Order | 59 | – | – |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | 56 | – | – |
| CWE-440 | Expected Behavior Violation | 49 | – | – |
| CWE-183 | Permissive List of Allowed Inputs | 48 | – | – |
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | 44 | – | – |
| CWE-1288 | Improper Validation of Consistency within Input | 43 | – | – |
| CWE-691 | Insufficient Control Flow Management | 40 | – | – |
| CWE-606 | Unchecked Input for Loop Condition | 39 | – | – |
| CWE-185 | Incorrect Regular Expression | 37 | – | – |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | 36 | – | – |
| CWE-757 | Selection of Less-Secure Algorithm During Negotiation | 34 | – | – |
| CWE-115 | Misinterpretation of Input | 33 | – | – |
| CWE-233 | Improper Handling of Parameters | 32 | – | – |
| CWE-241 | Improper Handling of Unexpected Data Type | 32 | – | – |
| CWE-684 | Incorrect Provision of Specified Functionality | 31 | – | – |
| CWE-390 | Detection of Error Condition Without Action | 30 | – | – |
| CWE-460 | Improper Cleanup on Thrown Exception | 30 | – | – |
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | 26 | – | – |
| CWE-391 | CWE-391 | 25 | – | – |
| CWE-707 | Improper Neutralization | 25 | – | – |
| CWE-690 | Unchecked Return Value to NULL Pointer Dereference | 24 | – | – |
| CWE-228 | Improper Handling of Syntactically Invalid Structure | 23 | – | – |
| CWE-253 | Incorrect Check of Function Return Value | 22 | – | – |
| CWE-625 | Permissive Regular Expression | 22 | – | – |
| CWE-698 | Execution After Redirect (EAR) | 22 | – | – |
| CWE-783 | Operator Precedence Logic Error | 22 | – | – |
| CWE-187 | Partial String Comparison | 21 | – | – |
| CWE-1025 | Comparison Using Wrong Factors | 21 | – | – |
| CWE-708 | Incorrect Ownership Assignment | 20 | – | – |
| CWE-229 | Improper Handling of Values | 18 | – | – |
| CWE-837 | Improper Enforcement of a Single, Unique Action | 18 | – | – |
| CWE-394 | Unexpected Status Code or Return Value | 17 | – | – |
| CWE-395 | Use of NullPointerException Catch to Detect NULL Pointer Dereference | 17 | – | – |
| CWE-1023 | Incomplete Comparison with Missing Factors | 17 | – | – |
| CWE-838 | Inappropriate Encoding for Output Context | 16 | – | – |
| CWE-449 | The UI Performs the Wrong Action | 14 | – | – |
| CWE-650 | Trusting HTTP Permission Methods on the Server Side | 14 | – | – |
| CWE-474 | Use of Function with Inconsistent Implementations | 13 | – | – |
| CWE-230 | Improper Handling of Missing Values | 12 | – | – |
| CWE-232 | Improper Handling of Undefined Values | 11 | – | – |
| CWE-480 | Use of Incorrect Operator | 11 | – | – |
| CWE-392 | Missing Report of Error Condition | 10 | – | – |
| CWE-710 | Improper Adherence to Coding Standards | 9 | – | – |
| CWE-839 | Numeric Range Comparison Without Minimum Check | 9 | – | – |
| CWE-393 | Return of Wrong Status Code | 8 | – | – |
| CWE-544 | Missing Standardized Error Handling Mechanism | 8 | – | – |
| CWE-686 | Function Call With Incorrect Argument Type | 7 | – | – |
| CWE-1037 | Processor Optimization Removal or Modification of Security-critical Code | 7 | – | – |
| CWE-1077 | Floating Point Comparison with Incorrect Operator | 7 | – | – |
| CWE-777 | Regular Expression without Anchors | 6 | – | – |
| CWE-1007 | Insufficient Visual Distinction of Homoglyphs Presented to User | 6 | – | – |
| CWE-1038 | Insecure Automated Optimizations | 6 | – | – |
| CWE-231 | Improper Handling of Extra Values | 5 | – | – |
| CWE-235 | Improper Handling of Extra Parameters | 5 | – | – |
| CWE-237 | Improper Handling of Structural Elements | 5 | – | – |
| CWE-628 | Function Call with Incorrectly Specified Arguments | 5 | – | – |
| CWE-688 | Function Call With Incorrect Variable or Reference as Argument | 5 | – | – |
| CWE-705 | Incorrect Control Flow Scoping | 5 | – | – |
| CWE-733 | Compiler Optimization Removal or Modification of Security-critical Code | 5 | – | – |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | 5 | – | – |
| CWE-1245 | Improper Finite State Machines (FSMs) in Hardware Logic | 5 | – | – |
| CWE-386 | Symbolic Name not Mapping to Correct Object | 4 | – | – |
| CWE-437 | Incomplete Model of Endpoint Features | 4 | – | – |
| CWE-239 | Failure to Handle Incomplete Element | 3 | – | – |
| CWE-240 | Improper Handling of Inconsistent Structural Elements | 3 | – | – |
| CWE-435 | Improper Interaction Between Multiple Correctly-Behaving Entities | 3 | – | – |
| CWE-446 | UI Discrepancy for Security Feature | 3 | – | – |
| CWE-448 | Obsolete Feature in UI | 3 | – | – |
| CWE-473 | PHP External Variable Modification | 3 | – | – |
| CWE-597 | Use of Wrong Operator in String Comparison | 3 | – | – |
| CWE-683 | Function Call With Incorrect Order of Arguments | 3 | – | – |
| CWE-756 | Missing Custom Error Page | 3 | – | – |
| CWE-1024 | Comparison of Incompatible Types | 3 | – | – |
| CWE-1280 | Access Control Check Implemented After Asset is Accessed | 3 | – | – |
| CWE-182 | Collapse of Data into Unsafe Value | 2 | – | – |
| CWE-186 | Overly Restrictive Regular Expression | 2 | – | – |
| CWE-234 | Failure to Handle Missing Parameter | 2 | – | – |
| CWE-236 | Improper Handling of Undefined Parameters | 2 | – | – |
| CWE-396 | Declaration of Catch for Generic Exception | 2 | – | – |
| CWE-622 | Improper Validation of Function Hook Arguments | 2 | – | – |
| CWE-687 | Function Call With Incorrectly Specified Argument Value | 2 | – | – |
| CWE-1103 | Use of Platform-Dependent Third Party Components | 2 | – | – |
| CWE-1190 | DMA Device Enabled Too Early in Boot Phase | 2 | – | – |
| CWE-1279 | Cryptographic Operations are Run Before Supporting Units are Ready | 2 | – | – |
| CWE-478 | Missing Default Case in Multiple Condition Expression | 1 | – | – |
| CWE-483 | Incorrect Block Delimitation | 1 | – | – |
| CWE-484 | Omitted Break Statement in Switch | 1 | – | – |
| CWE-600 | Uncaught Exception in Servlet | 1 | – | – |
| CWE-768 | Incorrect Short Circuit Evaluation | 1 | – | – |
| CWE-781 | Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code | 1 | – | – |
| CWE-1102 | Reliance on Machine-Dependent Data Representation | 1 | – | – |
| CWE-1471 | Insufficiently Controlled Parser Differential | 1 | – | – |