CWE Top 25 Most Dangerous Software Weaknesses (2024)
The 2024 CWE Top 25 Most Dangerous Software Weaknesses published by MITRE Corporation and supported by CISA. Based on analysis of 31,770 CVE records scored by frequency multiplied by severity (CVSS). Identifies the most common and impactful software weaknesses that developers and organizations should prioritize. Released November 19, 2024.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
CWE Top 25 2024: Access Control and Authorization
| Code | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) |
| CWE-269 | Improper Privilege Management |
| CWE-352 | Cross-Site Request Forgery (CSRF) |
| CWE-862 | Missing Authorization |
| CWE-863 | Incorrect Authorization |
CWE Top 25 2024: Authentication and Credentials
| Code | Title |
|---|---|
| CWE-287 | Improper Authentication |
| CWE-306 | Missing Authentication for Critical Function |
| CWE-798 | Use of Hard-coded Credentials |
CWE Top 25 2024: Data and Resource Handling
| Code | Title |
|---|---|
| CWE-400 | Uncontrolled Resource Consumption |
| CWE-502 | Deserialization of Untrusted Data |
| CWE-918 | Server-Side Request Forgery (SSRF) |
CWE Top 25 2024: Injection and Input Handling
| Code | Title |
|---|---|
| CWE-20 | Improper Input Validation |
| CWE-434 | Unrestricted Upload of File with Dangerous Type |
| CWE-77 | Improper Neutralization of Special Elements used in a Command (Command Injection) |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) |
| CWE-79 | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) |
| CWE-94 | Improper Control of Generation of Code (Code Injection) |
CWE Top 25 2024: Memory Safety
| Code | Title |
|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
| CWE-125 | Out-of-bounds Read |
| CWE-190 | Integer Overflow or Wraparound |
| CWE-416 | Use After Free |
| CWE-476 | NULL Pointer Dereference |
| CWE-787 | Out-of-bounds Write |
Maps to 2 other frameworks
Frequently Asked Questions
What is CWE Top 25 Most Dangerous Software Weaknesses (2024)?
CWE Top 25 Most Dangerous Software Weaknesses (2024) is a compliance framework from International with 5 domains and 25 controls. The 2024 CWE Top 25 Most Dangerous Software Weaknesses published by MITRE Corporation and supported by CISA. Based on analysis of 31,770 CVE records scored by frequency multiplied by severity (CVSS). Identifies the most common and impactful software weaknesses that developers and organizations should prioritize. Released November 19, 2024. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does CWE Top 25 Most Dangerous Software Weaknesses (2024) have?
CWE Top 25 Most Dangerous Software Weaknesses (2024) has 25 controls organised across 5 domains. The largest domains are CWE Top 25 2024: Injection and Input Handling (7 controls), CWE Top 25 2024: Access Control and Authorization (6 controls), CWE Top 25 2024: Memory Safety (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does CWE Top 25 Most Dangerous Software Weaknesses (2024) map to?
CWE Top 25 Most Dangerous Software Weaknesses (2024) maps to 2 other compliance frameworks. The top mapping partners are OWASP Top 10:2025 (72% coverage), HL7 FHIR Security Framework (24% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with CWE Top 25 Most Dangerous Software Weaknesses (2024) compliance?
Start your CWE Top 25 Most Dangerous Software Weaknesses (2024) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CWE Top 25 Most Dangerous Software Weaknesses (2024) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.
Get Started Free →Free forever — no credit card required