| CWE-189 | Numeric Errors | 1,171 | 1 | 0 |
| CWE-254 | Security Features | 352 | 0 | 0 |
| CWE-19 | Data Processing Errors | 226 | 0 | 1 |
| CWE-17 | Code | 161 | 0 | 0 |
| CWE-672 | Operation on a Resource after Expiration or Release | 85 | 0 | 0 |
| CWE-664 | Improper Control of a Resource Through its Lifetime | 57 | 1 | 0 |
| CWE-778 | Insufficient Logging | 40 | 1 | 0 |
| CWE-471 | Modification of Assumed-Immutable Data (MAID) | 38 | 0 | 0 |
| CWE-388 | Error Handling | 37 | 1 | 0 |
| CWE-385 | Covert Timing Channel | 36 | 0 | 0 |
| CWE-92 | CWE-92 | 34 | 0 | 0 |
| CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control | 27 | 0 | 0 |
| CWE-357 | Insufficient UI Warning of Dangerous Operations | 24 | – | – |
| CWE-501 | Trust Boundary Violation | 22 | – | – |
| CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges | 19 | – | – |
| CWE-1259 | Improper Restriction of Security Token Assignment | 18 | – | – |
| CWE-1263 | Improper Physical Access Control | 15 | – | – |
| CWE-475 | Undefined Behavior for Input to API | 14 | – | – |
| CWE-1035 | CWE-1035 | 13 | – | – |
| CWE-417 | Communication Channel Errors | 12 | – | – |
| CWE-701 | CWE-701 | 12 | – | – |
| CWE-372 | Incomplete Internal State Distinction | 11 | – | – |
| CWE-371 | State Issues | 10 | – | – |
| CWE-547 | Use of Hard-coded, Security-relevant Constants | 10 | – | – |
| CWE-223 | Omission of Security-relevant Information | 9 | – | – |
| CWE-1326 | Missing Immutable Root of Trust in Hardware | 9 | – | – |
| CWE-1357 | Reliance on Insufficiently Trustworthy Component | 9 | – | – |
| CWE-199 | Information Management Errors | 8 | – | – |
| CWE-221 | Information Loss or Omission | 8 | – | – |
| CWE-561 | Dead Code | 8 | – | – |
| CWE-1250 | Improper Preservation of Consistency Between Independent Representations of Shared State | 8 | – | – |
| CWE-1270 | Generation of Incorrect Security Tokens | 8 | – | – |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code | 8 | – | – |
| CWE-361 | Time and State | 7 | – | – |
| CWE-573 | Improper Following of Specification by Caller | 7 | – | – |
| CWE-18 | Source Code | 6 | – | – |
| CWE-249 | CWE-249 | 6 | – | – |
| CWE-1281 | Sequence of Processor Instructions Leads to Unexpected Behavior | 6 | – | – |
| CWE-1320 | Improper Protection for Outbound Error Messages and Alert Signals | 6 | – | – |
| CWE-1329 | Reliance on Component That is Not Updateable | 6 | – | – |
| CWE-1335 | Incorrect Bitwise Shift of Integer | 6 | – | – |
| CWE-1341 | Multiple Releases of Same Resource or Handle | 6 | – | – |
| CWE-1032 | CWE-1032 | 5 | – | – |
| CWE-1125 | Excessive Attack Surface | 5 | – | – |
| CWE-1384 | Improper Handling of Physical or Environmental Conditions | 5 | – | – |
| CWE-216 | CWE-216 | 4 | – | – |
| CWE-666 | Operation on Resource in Wrong Phase of Lifetime | 4 | – | – |
| CWE-675 | Multiple Operations on Resource in Single-Operation Context | 4 | – | – |
| CWE-1247 | Improper Protection Against Voltage and Clock Glitches | 4 | – | – |
| CWE-1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions | 4 | – | – |
| CWE-1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) | 4 | – | – |
| CWE-227 | CWE-227 | 3 | – | – |
| CWE-430 | Deployment of Wrong Handler | 3 | – | – |
| CWE-450 | Multiple Interpretations of UI Input | 3 | – | – |
| CWE-463 | Deletion of Data Structure Sentinel | 3 | – | – |
| CWE-557 | Concurrency Issues | 3 | – | – |
| CWE-605 | Multiple Binds to the Same Port | 3 | – | – |
| CWE-1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism | 3 | – | – |
| CWE-1108 | Excessive Reliance on Global Variables | 3 | – | – |
| CWE-1116 | Inaccurate Source Code Comments | 3 | – | – |
| CWE-1187 | Use of Uninitialized Resource | 3 | – | – |
| CWE-1231 | Improper Prevention of Lock Bit Modification | 3 | – | – |
| CWE-1332 | Improper Handling of Faults that Lead to Instruction Skips | 3 | – | – |
| CWE-1426 | Improper Validation of Generative AI Output | 3 | – | – |
| CWE-1 | CWE-1 | 2 | – | – |
| CWE-111 | Direct Use of Unsafe JNI | 2 | – | – |
| CWE-431 | Missing Handler | 2 | – | – |
| CWE-514 | Covert Channel | 2 | – | – |
| CWE-563 | Assignment to Variable without Use | 2 | – | – |
| CWE-769 | CWE-769 | 2 | – | – |
| CWE-815 | CWE-815 | 2 | – | – |
| CWE-882 | CWE-882 | 2 | – | – |
| CWE-1018 | CWE-1018 | 2 | – | – |
| CWE-1027 | CWE-1027 | 2 | – | – |
| CWE-1068 | Inconsistency Between Implementation and Documented Design | 2 | – | – |
| CWE-1076 | Insufficient Adherence to Expected Conventions | 2 | – | – |
| CWE-1100 | Insufficient Isolation of System-Dependent Functions | 2 | – | – |
| CWE-1107 | Insufficient Isolation of Symbolic Constant Definitions | 2 | – | – |
| CWE-1164 | Irrelevant Code | 2 | – | – |
| CWE-1269 | Product Released in Non-Release Configuration | 2 | – | – |
| CWE-1283 | Mutable Attestation or Measurement Reporting Data | 2 | – | – |
| CWE-1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation | 2 | – | – |
| CWE-1323 | Improper Management of Sensitive Trace Data | 2 | – | – |
| CWE-1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy | 2 | – | – |
| CWE-1463 | Insufficient Session Timeout Value | 2 | – | – |
| CWE-1464 | Improper Session Invalidation | 2 | – | – |
| CWE-135 | Incorrect Calculation of Multi-Byte String Length | 1 | – | – |
| CWE-292 | CWE-292 | 1 | – | – |
| CWE-355 | CWE-355 | 1 | – | – |
| CWE-443 | CWE-443 | 1 | – | – |
| CWE-485 | Insufficient Encapsulation | 1 | – | – |
| CWE-570 | Expression is Always False | 1 | – | – |
| CWE-673 | External Influence of Sphere Definition | 1 | – | – |
| CWE-702 | CWE-702 | 1 | – | – |
| CWE-714 | CWE-714 | 1 | – | – |
| CWE-895 | CWE-895 | 1 | – | – |
| CWE-952 | CWE-952 | 1 | – | – |
| CWE-1026 | CWE-1026 | 1 | – | – |
| CWE-1057 | Data Access Operations Outside of Expected Data Manager Component | 1 | – | – |
| CWE-1066 | Missing Serialization Control Element | 1 | – | – |
| CWE-1078 | Inappropriate Source Code Style or Formatting | 1 | – | – |
| CWE-1083 | Data Access from Outside Expected Data Manager Component | 1 | – | – |
| CWE-1106 | Insufficient Use of Symbolic Constants | 1 | – | – |
| CWE-1113 | Inappropriate Comment Style | 1 | – | – |
| CWE-1119 | Excessive Use of Unconditional Branching | 1 | – | – |
| CWE-1124 | Excessively Deep Nesting | 1 | – | – |
| CWE-1149 | CWE-1149 | 1 | – | – |
| CWE-1218 | CWE-1218 | 1 | – | – |
| CWE-1251 | Mirrored Regions with Different Values | 1 | – | – |
| CWE-1253 | Incorrect Selection of Fuse Values | 1 | – | – |
| CWE-1276 | Hardware Child Block Incorrectly Connected to Parent System | 1 | – | – |
| CWE-1277 | Firmware Not Updateable | 1 | – | – |
| CWE-1278 | Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques | 1 | – | – |
| CWE-1290 | Incorrect Decoding of Security Identifiers | 1 | – | – |
| CWE-1291 | Public Key Re-Use for Signing both Debug and Production Code | 1 | – | – |
| CWE-1294 | Insecure Security Identifier Mechanism | 1 | – | – |
| CWE-1310 | Missing Ability to Patch ROM Code | 1 | – | – |
| CWE-1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall | 1 | – | – |
| CWE-1313 | Hardware Allows Activation of Test or Debug Logic at Runtime | 1 | – | – |
| CWE-1316 | Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges | 1 | – | – |
| CWE-1339 | Insufficient Precision or Accuracy of a Real Number | 1 | – | – |
| CWE-1352 | CWE-1352 | 1 | – | – |
| CWE-1366 | CWE-1366 | 1 | – | – |
| CWE-1465 | Improper Session Invalidation after User Logout | 1 | – | – |
| CWE-1466 | Improper Session Invalidation after Authentication Credential Change | 1 | – | – |