Weaknesses

Weaknesses (CWE) behind CISA KEV entries

Which kinds of mistake lead to exploited vulnerabilities. An entry can list several CWEs, so shares add up to more than 100%.

Catalog: 2026.09.23
CWEs: 185
Entries without CWE: 175

Answer KEV entries list 185 distinct CWEs. The most common is CWE-20 (Improper input validation) on 119 entries, 6.9% of the catalog. 175 entries list no CWE.

TTop 15

Top 15 CWEs by KEV entries
CWE	Entries	Share of catalog
CWE-20 Improper input validation	119	6.9%
CWE-78 OS command injection	110	6.4%
CWE-787 Out-of-bounds write	104	6%
CWE-416 Use after free	93	5.4%
CWE-119 Memory buffer bounds error	85	4.9%
CWE-22 Path traversal	79	4.6%
CWE-502 Unsafe deserialization	71	4.1%
CWE-94 Code injection	70	4.1%
CWE-287 Improper authentication	47	2.7%
CWE-306 Missing authentication	42	2.4%
CWE-843 Type confusion	38	2.2%
CWE-284 Improper access control	36	2.1%
CWE-79 Cross-site scripting (XSS)	33	1.9%
CWE-122 Heap-based buffer overflow	33	1.9%
CWE-89 SQL injection	32	1.9%

AAll weaknesses

All 185 CWEs listed in CISA KEV
CWE	Name	Rank	Entries	Share	Vendors
CWE-20	Improper input validation	1	119	6.9%	42
CWE-78	OS command injection	2	110	6.4%	65
CWE-787	Out-of-bounds write	3	104	6%	21
CWE-416	Use after free	4	93	5.4%	12
CWE-119	Memory buffer bounds error	5	85	4.9%	18
CWE-22	Path traversal	6	79	4.6%	55
CWE-502	Unsafe deserialization	7	71	4.1%	36
CWE-94	Code injection	8	70	4.1%	37
CWE-287	Improper authentication	9	47	2.7%	31
CWE-306	Missing authentication	10	42	2.4%	29
CWE-843	Type confusion	11	38	2.2%	6
CWE-284	Improper access control	12	36	2.1%	22
CWE-79	Cross-site scripting (XSS)	13	33	1.9%	15
CWE-122	Heap-based buffer overflow	14	33	1.9%	13
CWE-89	SQL injection	15	32	1.9%	24
CWE-264	Permissions and access controls (category)	16	31	1.8%	8
CWE-77	Command injection	17	30	1.7%	20
CWE-200	Information exposure	18	25	1.5%	15
CWE-434	Unrestricted file upload	19	23	1.3%	22
CWE-918	Server-side request forgery	20	22	1.3%	14
CWE-288	Authentication bypass via alternate path	21	21	1.2%	13
CWE-269	Improper privilege management	22	18	1%	9
CWE-399	Resource management errors (category)	23	18	1%	3
CWE-59	Link following	24	17	1%	4
CWE-125	Out-of-bounds read	25	17	1%	9
CWE-863	Incorrect authorization	26	17	1%	14
CWE-190	Integer overflow	27	16	0.9%	7
CWE-74	Injection	28	12	0.7%	10
CWE-120	Classic buffer overflow	29	12	0.7%	9
CWE-121	Stack-based buffer overflow	30	12	0.7%	8
CWE-362	Race condition	31	12	0.7%	7
CWE-862	Missing authorization	32	12	0.7%	10
CWE-693	Protection mechanism failure	33	11	0.6%	4
CWE-23	Relative path traversal	34	9	0.5%	7
CWE-506	see MITRE	35	8	0.5%	8
CWE-611	XML external entity (XXE)	36	8	0.5%	7
CWE-798	Hard-coded credentials	37	8	0.5%	8
CWE-138	see MITRE	38	7	0.4%	5
CWE-95	Eval injection	39	6	0.3%	6
CWE-189	see MITRE	40	6	0.3%	3
CWE-352	Cross-site request forgery	41	6	0.3%	6
CWE-404	see MITRE	42	6	0.3%	1
CWE-36	see MITRE	43	5	0.3%	3
CWE-73	see MITRE	44	5	0.3%	3
CWE-88	see MITRE	45	5	0.3%	5
CWE-276	Incorrect default permissions	46	5	0.3%	4
CWE-290	see MITRE	47	5	0.3%	5
CWE-295	see MITRE	48	5	0.3%	4
CWE-347	see MITRE	49	5	0.3%	5
CWE-367	see MITRE	50	5	0.3%	4
CWE-400	Uncontrolled resource consumption	51	5	0.3%	4
CWE-822	see MITRE	52	5	0.3%	1
CWE-917	see MITRE	53	5	0.3%	3
CWE-1188	see MITRE	54	5	0.3%	3
CWE-116	see MITRE	55	4	0.2%	4
CWE-184	see MITRE	56	4	0.2%	4
CWE-326	see MITRE	57	4	0.2%	3
CWE-415	Double free	58	4	0.2%	4
CWE-444	see MITRE	59	4	0.2%	3
CWE-494	see MITRE	60	4	0.2%	4
CWE-522	see MITRE	61	4	0.2%	4
CWE-754	see MITRE	62	4	0.2%	3
CWE-80	see MITRE	63	3	0.2%	2
CWE-134	see MITRE	64	3	0.2%	3
CWE-158	see MITRE	65	3	0.2%	3
CWE-250	see MITRE	66	3	0.2%	2
CWE-285	Improper authorization	67	3	0.2%	3
CWE-552	see MITRE	68	3	0.2%	3
CWE-755	see MITRE	69	3	0.2%	3
CWE-807	see MITRE	70	3	0.2%	2
CWE-908	see MITRE	71	3	0.2%	3
CWE-912	see MITRE	72	3	0.2%	3
CWE-1220	see MITRE	73	3	0.2%	1
CWE-1336	see MITRE	74	3	0.2%	3
CWE-1386	see MITRE	75	3	0.2%	1
CWE-1390	see MITRE	76	3	0.2%	1
CWE-19	see MITRE	77	2	0.1%	1
CWE-25	see MITRE	78	2	0.1%	2
CWE-35	see MITRE	79	2	0.1%	2
CWE-96	see MITRE	80	2	0.1%	2
CWE-191	see MITRE	81	2	0.1%	2
CWE-209	see MITRE	82	2	0.1%	2
CWE-255	see MITRE	83	2	0.1%	2
CWE-259	see MITRE	84	2	0.1%	2
CWE-282	see MITRE	85	2	0.1%	2
CWE-303	see MITRE	86	2	0.1%	2
CWE-305	see MITRE	87	2	0.1%	2
CWE-420	see MITRE	88	2	0.1%	2
CWE-425	see MITRE	89	2	0.1%	2
CWE-426	see MITRE	90	2	0.1%	1
CWE-427	see MITRE	91	2	0.1%	1
CWE-436	see MITRE	92	2	0.1%	2
CWE-441	see MITRE	93	2	0.1%	2
CWE-451	see MITRE	94	2	0.1%	1
CWE-470	see MITRE	95	2	0.1%	2
CWE-473	see MITRE	96	2	0.1%	1
CWE-532	see MITRE	97	2	0.1%	2
CWE-591	see MITRE	98	2	0.1%	1
CWE-610	see MITRE	99	2	0.1%	2
CWE-648	see MITRE	100	2	0.1%	1
CWE-665	see MITRE	101	2	0.1%	2
CWE-667	see MITRE	102	2	0.1%	1
CWE-704	see MITRE	103	2	0.1%	2
CWE-707	see MITRE	104	2	0.1%	1
CWE-732	Incorrect permission assignment	105	2	0.1%	2
CWE-749	see MITRE	106	2	0.1%	2
CWE-823	see MITRE	107	2	0.1%	2
CWE-829	see MITRE	108	2	0.1%	2
CWE-940	see MITRE	109	2	0.1%	2
CWE-1173	see MITRE	110	2	0.1%	1
CWE-1285	see MITRE	111	2	0.1%	1
CWE-27	see MITRE	112	1	0.1%	1
CWE-39	see MITRE	113	1	0.1%	1
CWE-40	see MITRE	114	1	0.1%	1
CWE-44	see MITRE	115	1	0.1%	1
CWE-55	see MITRE	116	1	0.1%	1
CWE-61	see MITRE	117	1	0.1%	1
CWE-91	see MITRE	118	1	0.1%	1
CWE-93	see MITRE	119	1	0.1%	1
CWE-98	see MITRE	120	1	0.1%	1
CWE-114	see MITRE	121	1	0.1%	1
CWE-123	see MITRE	122	1	0.1%	1
CWE-124	see MITRE	123	1	0.1%	1
CWE-130	see MITRE	124	1	0.1%	1
CWE-131	see MITRE	125	1	0.1%	1
CWE-178	see MITRE	126	1	0.1%	1
CWE-193	see MITRE	127	1	0.1%	1
CWE-197	see MITRE	128	1	0.1%	1
CWE-203	see MITRE	129	1	0.1%	1
CWE-244	see MITRE	130	1	0.1%	1
CWE-254	see MITRE	131	1	0.1%	1
CWE-257	see MITRE	132	1	0.1%	1
CWE-266	see MITRE	133	1	0.1%	1
CWE-267	see MITRE	134	1	0.1%	1
CWE-273	see MITRE	135	1	0.1%	1
CWE-274	see MITRE	136	1	0.1%	1
CWE-280	see MITRE	137	1	0.1%	1
CWE-281	see MITRE	138	1	0.1%	1
CWE-294	see MITRE	139	1	0.1%	1
CWE-310	see MITRE	140	1	0.1%	1
CWE-311	see MITRE	141	1	0.1%	1
CWE-321	see MITRE	142	1	0.1%	1
CWE-324	see MITRE	143	1	0.1%	1
CWE-330	see MITRE	144	1	0.1%	1
CWE-346	see MITRE	145	1	0.1%	1
CWE-351	see MITRE	146	1	0.1%	1
CWE-353	see MITRE	147	1	0.1%	1
CWE-357	see MITRE	148	1	0.1%	1
CWE-358	see MITRE	149	1	0.1%	1
CWE-388	see MITRE	150	1	0.1%	1
CWE-390	see MITRE	151	1	0.1%	1
CWE-401	see MITRE	152	1	0.1%	1
CWE-406	see MITRE	153	1	0.1%	1
CWE-424	see MITRE	154	1	0.1%	1
CWE-472	see MITRE	155	1	0.1%	1
CWE-476	NULL pointer dereference	156	1	0.1%	1
CWE-497	see MITRE	157	1	0.1%	1
CWE-521	see MITRE	158	1	0.1%	1
CWE-528	see MITRE	159	1	0.1%	1
CWE-565	see MITRE	160	1	0.1%	1
CWE-601	see MITRE	161	1	0.1%	1
CWE-639	see MITRE	162	1	0.1%	1
CWE-641	see MITRE	163	1	0.1%	1
CWE-645	see MITRE	164	1	0.1%	1
CWE-647	see MITRE	165	1	0.1%	1
CWE-653	see MITRE	166	1	0.1%	1
CWE-664	see MITRE	167	1	0.1%	1
CWE-668	see MITRE	168	1	0.1%	1
CWE-669	see MITRE	169	1	0.1%	1
CWE-697	see MITRE	170	1	0.1%	1
CWE-703	see MITRE	171	1	0.1%	1
CWE-706	see MITRE	172	1	0.1%	1
CWE-772	see MITRE	173	1	0.1%	1
CWE-782	see MITRE	174	1	0.1%	1
CWE-783	see MITRE	175	1	0.1%	1
CWE-785	see MITRE	176	1	0.1%	1
CWE-790	see MITRE	177	1	0.1%	1
CWE-824	see MITRE	178	1	0.1%	1
CWE-835	see MITRE	179	1	0.1%	1
CWE-913	see MITRE	180	1	0.1%	1
CWE-923	see MITRE	181	1	0.1%	1
CWE-1023	see MITRE	182	1	0.1%	1
CWE-1287	see MITRE	183	1	0.1%	1
CWE-1321	Prototype pollution	184	1	0.1%	1
CWE-1393	see MITRE	185	1	0.1%	1

Cite this

The most common weakness in CISA's KEV catalog is CWE-20 (Improper input validation), listed on 119 entries. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

`/`	Focus search
`?`	Show this panel
`Esc`	Close panel or clear search
`g` `d`	Go to Dashboard
`g` `k`	Go to KEV
`g` `v`	Go to Vendors
`g` `p`	Go to Products
`g` `w`	Go to Weaknesses
`g` `s`	Go to Stats
`g` `r`	Go to Regulations
`g` `b`	Go to Briefings
`g` `a`	Go to API