Weakness class · SUPPLY
Supply Chain and Malicious Code
862 published CVEs name a weakness in this class; 19 of them are exploited in the wild.
CWEs in this class12
| CWE | Weakness | CVEs | Exploited | Check |
|---|---|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 314 | 3 | 5 |
| CWE-494 | Download of Code Without Integrity Check | 236 | 4 | 1 |
| CWE-506 | Embedded Malicious Code | 103 | 9 | 1 |
| CWE-912 | Hidden Functionality | 98 | 3 | 1 |
| CWE-1395 | Dependency on Vulnerable Third-Party Component | 52 | 0 | 0 |
| CWE-1104 | Use of Unmaintained Third Party Components | 29 | 0 | 0 |
| CWE-1242 | Inclusion of Undocumented Features or Chicken Bits | 14 | 0 | 0 |
| CWE-830 | Inclusion of Web Functionality from an Untrusted Source | 12 | 0 | 0 |
| CWE-507 | Trojan Horse | 1 | 0 | 0 |
| CWE-508 | Non-Replicating Malicious Code | 1 | 0 | 0 |
| CWE-509 | Replicating Malicious Code (Virus or Worm) | 1 | 0 | 0 |
| CWE-511 | Logic/Time Bomb | 1 | 0 | 0 |
Exploited and check counts are given for the class's largest CWEs; open a CWE for its CVEs.
Data as of 2026-11-14.