{"meta":{"title":"Top weaknesses (CWE) in KEV","description":"The 15 CWEs listed on the most entries. Entries may list several CWEs.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":15},"data":[{"rank":1,"cwe":"CWE-20","name":"Improper Input Validation","entries":119,"shareOfCatalogPercent":6.9},{"rank":2,"cwe":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","entries":110,"shareOfCatalogPercent":6.4},{"rank":3,"cwe":"CWE-787","name":"Out-of-bounds Write","entries":104,"shareOfCatalogPercent":6.0},{"rank":4,"cwe":"CWE-416","name":"Use After Free","entries":93,"shareOfCatalogPercent":5.4},{"rank":5,"cwe":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","entries":85,"shareOfCatalogPercent":4.9},{"rank":6,"cwe":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","entries":79,"shareOfCatalogPercent":4.6},{"rank":7,"cwe":"CWE-502","name":"Deserialization of Untrusted Data","entries":71,"shareOfCatalogPercent":4.1},{"rank":8,"cwe":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","entries":70,"shareOfCatalogPercent":4.1},{"rank":9,"cwe":"CWE-287","name":"Improper Authentication","entries":47,"shareOfCatalogPercent":2.7},{"rank":10,"cwe":"CWE-306","name":"Missing Authentication for Critical Function","entries":42,"shareOfCatalogPercent":2.4},{"rank":11,"cwe":"CWE-843","name":"Access of Resource Using Incompatible Type ('Type Confusion')","entries":38,"shareOfCatalogPercent":2.2},{"rank":12,"cwe":"CWE-284","name":"Improper Access Control","entries":36,"shareOfCatalogPercent":2.1},{"rank":13,"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","entries":33,"shareOfCatalogPercent":1.9},{"rank":14,"cwe":"CWE-122","name":"Heap-based Buffer Overflow","entries":33,"shareOfCatalogPercent":1.9},{"rank":15,"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","entries":32,"shareOfCatalogPercent":1.9}]}