TheArtOfService
Back to Frameworks

CWE Top 25 Most Dangerous Software Weaknesses (2024)

Self-Assess
International
v2024
6 domains
25 controls

The 2024 CWE Top 25 Most Dangerous Software Weaknesses published by MITRE Corporation and supported by CISA. Based on analysis of 31,770 CVE records scored by frequency multiplied by severity (CVSS). Identifies the most common and impactful software weaknesses that developers and organizations should prioritize. Released November 19, 2024.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Authorization and Authentication

5 controls

Weaknesses related to access control and identity verification

Controls in the Authorization and Authentication domain of CWE Top 25 Most Dangerous Software Weaknesses (2024) — 5 controls
CodeTitle
CWE-269Improper Privilege Management
CWE-287Improper Authentication
CWE-306Missing Authentication for Critical Function
CWE-862Missing Authorization
CWE-863Incorrect Authorization

Data Protection and Integrity

3 controls

Weaknesses related to data exposure and integrity failures

Controls in the Data Protection and Integrity domain of CWE Top 25 Most Dangerous Software Weaknesses (2024) — 3 controls
CodeTitle
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
CWE-352Cross-Site Request Forgery (CSRF)
CWE-502Deserialization of Untrusted Data

File and Path Handling

1 controls

Weaknesses related to file operations and path traversal

Controls in the File and Path Handling domain of CWE Top 25 Most Dangerous Software Weaknesses (2024) — 1 controls
CodeTitle
CWE-22Path Traversal

Injection and Input Validation

7 controls

Weaknesses related to insufficient input validation and injection attacks

Controls in the Injection and Input Validation domain of CWE Top 25 Most Dangerous Software Weaknesses (2024) — 7 controls
CodeTitle
CWE-20Improper Input Validation
CWE-434Unrestricted Upload of File with Dangerous Type
CWE-77Command Injection
CWE-78OS Command Injection
CWE-79Cross-site Scripting (XSS)
CWE-89SQL Injection
CWE-94Code Injection

Memory Safety

6 controls

Weaknesses related to memory management errors

Controls in the Memory Safety domain of CWE Top 25 Most Dangerous Software Weaknesses (2024) — 6 controls
CodeTitle
CWE-119Improper Restriction of Operations within Memory Buffer Bounds
CWE-125Out-of-bounds Read
CWE-190Integer Overflow or Wraparound
CWE-416Use After Free
CWE-476NULL Pointer Dereference
CWE-787Out-of-bounds Write

Resource Management and Networking

3 controls

Weaknesses related to resource consumption, SSRF, and hardcoded credentials

Controls in the Resource Management and Networking domain of CWE Top 25 Most Dangerous Software Weaknesses (2024) — 3 controls
CodeTitle
CWE-400Uncontrolled Resource Consumption
CWE-798Use of Hard-coded Credentials
CWE-918Server-Side Request Forgery (SSRF)

Maps to 223 other frameworks

25 total controls
OWASP API Security Top 10:2023
6 source controls mapped|4 target controls covered
24%
Cyber Essentials Plus
6 source controls mapped|2 target controls covered
24%
CSA STAR (Security, Trust, Assurance, and Risk)
6 source controls mapped|1 target controls covered
24%
California IoT Security Law
6 source controls mapped|2 target controls covered
24%
NIST SP 800-171A — Assessing CUI Security Requirements
6 source controls mapped|6 target controls covered
24%
CSA CCM v4
6 source controls mapped|6 target controls covered
24%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
6 source controls mapped|3 target controls covered
24%
Azure Security Benchmark
6 source controls mapped|2 target controls covered
24%
OWASP Top 10:2025
6 source controls mapped|5 target controls covered
24%
BSI IT-Grundschutz
6 source controls mapped|2 target controls covered
24%
C5 (Germany)
6 source controls mapped|2 target controls covered
24%
OWASP ASVS
6 source controls mapped|2 target controls covered
24%
BSIMM
6 source controls mapped|2 target controls covered
24%
NIST SP 800-171A Rev 3 — Assessing CUI Security Requirements
6 source controls mapped|2 target controls covered
24%
Belgium CyberFundamentals
6 source controls mapped|2 target controls covered
24%
ASD Strategies to Mitigate Cyber Security Incidents
6 source controls mapped|3 target controls covered
24%
CMMC 2.0
6 source controls mapped|2 target controls covered
24%
HL7 FHIR Security Framework
6 source controls mapped|6 target controls covered
24%
CAIQ (CSA)
6 source controls mapped|2 target controls covered
24%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
6 source controls mapped|3 target controls covered
24%
3GPP Security
6 source controls mapped|2 target controls covered
24%
ISO/IEC 27400:2022
6 source controls mapped|1 target controls covered
24%
Australian Energy Sector Cyber Security Framework (AESCSF)
6 source controls mapped|2 target controls covered
24%
AWS Well-Architected Security Pillar
6 source controls mapped|2 target controls covered
24%
FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011)
6 source controls mapped|4 target controls covered
24%
CISA Zero Trust Maturity Model
6 source controls mapped|2 target controls covered
24%
ANSSI Cybersecurity Framework
6 source controls mapped|2 target controls covered
24%
ETSI EN 303 645
6 source controls mapped|2 target controls covered
24%
DISA Security Technical Implementation Guides (STIGs)
6 source controls mapped|5 target controls covered
24%
ASD Essential Eight Maturity Model
6 source controls mapped|6 target controls covered
24%
O-RAN Alliance Security Specifications (O-RAN.WG11)
6 source controls mapped|2 target controls covered
24%
DAMA-DMBOK2 — Data Management Body of Knowledge (2nd Edition)
6 source controls mapped|1 target controls covered
24%
NIST SP 800-53 Rev 5
6 source controls mapped|6 target controls covered
24%
SIG (Shared Assessments)
6 source controls mapped|2 target controls covered
24%
PropTech Security Standards — Smart Building Cybersecurity
6 source controls mapped|3 target controls covered
24%
OpenSSF Scorecard
6 source controls mapped|2 target controls covered
24%
NIST SP 800-146
6 source controls mapped|2 target controls covered
24%
ISO 27001:2022
6 source controls mapped|4 target controls covered
24%
Saudi NCA ECC
6 source controls mapped|2 target controls covered
24%
NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
6 source controls mapped|5 target controls covered
24%
NIST SP 800-190
6 source controls mapped|2 target controls covered
24%
NIST SP 800-92
6 source controls mapped|2 target controls covered
24%
Spain ENS
6 source controls mapped|2 target controls covered
24%
NIST SP 800-115
6 source controls mapped|2 target controls covered
24%
OWASP Top 10 for LLM Applications 2025
6 source controls mapped|4 target controls covered
24%
SSDF (NIST)
6 source controls mapped|2 target controls covered
24%
NIST SP 800-61
6 source controls mapped|2 target controls covered
24%
MDS2 (Medical Device)
6 source controls mapped|2 target controls covered
24%
ISO 27799
6 source controls mapped|2 target controls covered
24%
PTES
6 source controls mapped|2 target controls covered
24%
NIST SP 800-66
6 source controls mapped|2 target controls covered
24%
NIST SP 800-150
6 source controls mapped|2 target controls covered
24%
MTCS (Singapore)
6 source controls mapped|2 target controls covered
24%
NIST Privacy Framework 1.0
6 source controls mapped|4 target controls covered
24%
NIST Cybersecurity Framework 2.0
6 source controls mapped|3 target controls covered
24%
SSAE 18 — Attestation Standards (SOC Reporting)
6 source controls mapped|2 target controls covered
24%
MITRE D3FEND
6 source controls mapped|2 target controls covered
24%
South Korea ISMS-P
6 source controls mapped|2 target controls covered
24%
NIST SP 800-137
6 source controls mapped|2 target controls covered
24%
MITRE ATT&CK
6 source controls mapped|2 target controls covered
24%
SWIFT Customer Security Programme (CSP)
6 source controls mapped|3 target controls covered
24%
OWASP DevSecOps Maturity Model (DSOMM)
6 source controls mapped|3 target controls covered
24%
CISA ICS-CERT Advisories and Industrial Control Systems Security Guidelines
6 source controls mapped|6 target controls covered
24%
NIS2 Directive Implementing Acts
6 source controls mapped|7 target controls covered
24%
FBI CJIS Security Policy
6 source controls mapped|6 target controls covered
24%
FedRAMP Rev 5
6 source controls mapped|9 target controls covered
24%
UK PSTI Act
6 source controls mapped|2 target controls covered
24%
NIST SP 800-187
6 source controls mapped|2 target controls covered
24%
NIST SP 800-144
6 source controls mapped|2 target controls covered
24%
FISMA
6 source controls mapped|2 target controls covered
24%
SLSA
6 source controls mapped|2 target controls covered
24%
NIST SP 800-145
6 source controls mapped|2 target controls covered
24%
UK Gambling Commission — Cyber Resilience Requirements
6 source controls mapped|2 target controls covered
24%
NAIC Insurance Data Security Model Law (MDL-668)
6 source controls mapped|4 target controls covered
24%
EU Cyber Resilience Act
6 source controls mapped|2 target controls covered
24%
Zimbabwe Data Protection Act (2021)
6 source controls mapped|2 target controls covered
24%
TSA Pipeline Security
6 source controls mapped|1 target controls covered
24%
ISO 27002:2022
6 source controls mapped|2 target controls covered
24%
NIST SP 800-171
6 source controls mapped|2 target controls covered
24%
UK Telecommunications (Security) Act 2021
6 source controls mapped|2 target controls covered
24%
ASD Information Security Manual (ISM)
6 source controls mapped|7 target controls covered
24%
UNECE WP.29 R156
6 source controls mapped|2 target controls covered
24%
ISO/SAE 21434
6 source controls mapped|2 target controls covered
24%
NIST SP 800-128
6 source controls mapped|2 target controls covered
24%
ISO 13485
6 source controls mapped|2 target controls covered
24%
CNCF Cloud Native Security (Cloud Native Computing Foundation)
6 source controls mapped|1 target controls covered
24%
NIST SP 800-207
6 source controls mapped|2 target controls covered
24%
NIST SP 800-63
6 source controls mapped|2 target controls covered
24%
DoD Zero Trust Reference Architecture
6 source controls mapped|2 target controls covered
24%
FAA Cybersecurity Framework for Aviation
6 source controls mapped|1 target controls covered
24%
Oman National Cybersecurity Framework
6 source controls mapped|1 target controls covered
24%
UNECE WP.29 R155
6 source controls mapped|2 target controls covered
24%
NIST SP 800-123
6 source controls mapped|2 target controls covered
24%
PCI DSS v4.0
6 source controls mapped|3 target controls covered
24%
MARS-E
6 source controls mapped|2 target controls covered
24%
ISMAP (Japan)
6 source controls mapped|2 target controls covered
24%
TISAX — Trusted Information Security Assessment Exchange
6 source controls mapped|1 target controls covered
24%
WCO Authorised Economic Operator (AEO) Framework
6 source controls mapped|4 target controls covered
24%
Ghana Cybersecurity Act
6 source controls mapped|2 target controls covered
24%
NIST SP 800-183
6 source controls mapped|2 target controls covered
24%
OWASP SAMM
6 source controls mapped|2 target controls covered
24%
ISO 27018
6 source controls mapped|2 target controls covered
24%
FDA 21 CFR Part 11
6 source controls mapped|2 target controls covered
24%
NIST SP 800-172
6 source controls mapped|2 target controls covered
24%
NIST SP 800-161
6 source controls mapped|2 target controls covered
24%
NIST SP 800-218
6 source controls mapped|2 target controls covered
24%
TSA Pipeline Cybersecurity Directives
6 source controls mapped|1 target controls covered
24%
3GPP 5G Security Architecture (TS 33.501)
6 source controls mapped|5 target controls covered
24%
OWASP MASVS
6 source controls mapped|2 target controls covered
24%
NIST SP 800-82 Rev 3 — Guide to OT Security
6 source controls mapped|3 target controls covered
24%
NIST SP 800-53A
6 source controls mapped|2 target controls covered
24%
ISO 27017
6 source controls mapped|2 target controls covered
24%
CISA Secure by Design Principles
6 source controls mapped|3 target controls covered
24%
NIST SP 800-160
6 source controls mapped|2 target controls covered
24%
NIST SP 800-88
6 source controls mapped|2 target controls covered
24%
ISO 27043
6 source controls mapped|2 target controls covered
24%
NIST SP 800-181
6 source controls mapped|2 target controls covered
24%
EDM Council CDMC — Cloud Data Management Capabilities Framework
3 source controls mapped|1 target controls covered
12%
IEC 62351 — Power Systems Communication Security
3 source controls mapped|1 target controls covered
12%
Angola Personal Data Protection Law (Law No. 22/11)
3 source controls mapped|1 target controls covered
12%
EU Clinical Trials Regulation (CTR 536/2014)
3 source controls mapped|1 target controls covered
12%
MiFID II / MiFIR
3 source controls mapped|1 target controls covered
12%
FFIEC Cybersecurity Assessment Tool (CAT)
3 source controls mapped|1 target controls covered
12%
ISO/IEC 27011:2024
3 source controls mapped|1 target controls covered
12%
ICAO Annex 17 — Aviation Security (AVSEC)
3 source controls mapped|1 target controls covered
12%
Australia Consumer Data Right — Banking (CDR)
3 source controls mapped|3 target controls covered
12%
US Automated Commercial Environment (ACE) — CBP Trade Data Requirements
3 source controls mapped|1 target controls covered
12%
HITECH Act
3 source controls mapped|1 target controls covered
12%
Philippines Data Privacy Act (RA 10173)
3 source controls mapped|2 target controls covered
12%
EU Markets in Crypto-Assets Regulation (MiCA)
3 source controls mapped|3 target controls covered
12%
ISO/IEC 27006:2024
3 source controls mapped|1 target controls covered
12%
ISO/IEC 17025:2017 — General Requirements for Testing and Calibration Laboratories
3 source controls mapped|1 target controls covered
12%
ISO 15189:2022 — Medical Laboratories Requirements for Quality and Competence
3 source controls mapped|1 target controls covered
12%
ITAR — International Traffic in Arms Regulations
3 source controls mapped|2 target controls covered
12%
Authorised Economic Operator (AEO) Programmes — Global Standards
3 source controls mapped|1 target controls covered
12%
US NRC 10 CFR 73.54 — Cyber Security for Nuclear Power Plants
3 source controls mapped|1 target controls covered
12%
EAR — Export Administration Regulations
3 source controls mapped|3 target controls covered
12%
ISO 22739:2024 — Blockchain and Distributed Ledger Technologies Vocabulary
3 source controls mapped|3 target controls covered
12%
Security of Critical Infrastructure Act 2018 (SOCI)
3 source controls mapped|1 target controls covered
12%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
3 source controls mapped|1 target controls covered
12%
Samoa Telecommunications Act (2005) — Privacy & Data Protection
3 source controls mapped|2 target controls covered
12%
C-TPAT — Customs-Trade Partnership Against Terrorism
3 source controls mapped|3 target controls covered
12%
Defence Security Principles Framework (DSPF)
3 source controls mapped|3 target controls covered
12%
Protective Security Policy Framework (PSPF) Release 2024
3 source controls mapped|3 target controls covered
12%
ILO Declaration on Fundamental Principles and Rights at Work (Core Conventions)
3 source controls mapped|1 target controls covered
12%
SOC 2
3 source controls mapped|2 target controls covered
12%
Notifiable Data Breaches Scheme (Australia)
3 source controls mapped|1 target controls covered
12%
EU Digital Markets Act
3 source controls mapped|1 target controls covered
12%
FTC Health Breach Notification Rule
3 source controls mapped|1 target controls covered
12%
UK Product Security and Telecommunications Infrastructure Act (PSTI)
3 source controls mapped|1 target controls covered
12%
European Accessibility Act (Directive (EU) 2019/882)
3 source controls mapped|1 target controls covered
12%
EU Deforestation-Free Products Regulation (EUDR)
3 source controls mapped|1 target controls covered
12%
Ontario Accessibility for Ontarians with Disabilities Act (AODA) — IASR Web Standard
3 source controls mapped|1 target controls covered
12%
EU NIS2 Directive — Energy Sector Cybersecurity Requirements (Directive 2022/2555)
3 source controls mapped|1 target controls covered
12%
US ITAR and EAR — Export Control and Data Security
3 source controls mapped|1 target controls covered
12%
US SEC Digital Assets and Crypto Regulatory Framework
3 source controls mapped|1 target controls covered
12%
Australia eSafety Commissioner — Online Safety Expectations for Industry
3 source controls mapped|1 target controls covered
12%
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR)
3 source controls mapped|1 target controls covered
12%
ISO 19650 — Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)
3 source controls mapped|1 target controls covered
12%
ILO Tripartite Declaration of Principles concerning Multinational Enterprises (MNE Declaration)
3 source controls mapped|1 target controls covered
12%
Uganda Data Protection and Privacy Act (2019)
3 source controls mapped|1 target controls covered
12%
Armenia Law on Protection of Personal Data (2015)
3 source controls mapped|2 target controls covered
12%
ISO/IEC 23837 — Security Requirements for Quantum Key Distribution
3 source controls mapped|1 target controls covered
12%
eIDAS 2.0 — EU Digital Identity Regulation
3 source controls mapped|1 target controls covered
12%
ISO/IEC 29115:2023 — Entity Authentication Assurance Framework
3 source controls mapped|3 target controls covered
12%
DFARS 252.204-7012 — Safeguarding Covered Defense Information
3 source controls mapped|3 target controls covered
12%
Connecticut Data Privacy Act (CTDPA)
3 source controls mapped|5 target controls covered
12%
Illinois Biometric Information Privacy Act (BIPA)
3 source controls mapped|3 target controls covered
12%
Modern Slavery Act 2018 (Australia)
3 source controls mapped|3 target controls covered
12%
Chile Personal Data Protection Law (Law No. 21.719)
3 source controls mapped|1 target controls covered
12%
EMV 3-D Secure (3DS2) — Payment Authentication Protocol
3 source controls mapped|3 target controls covered
12%
3GPP Security Architecture (TS 33.501 — 5G Security)
3 source controls mapped|2 target controls covered
12%
Bank Secrecy Act / Anti-Money Laundering (BSA/AML)
3 source controls mapped|1 target controls covered
12%
AML/CTF Act 2006 (Australia)
3 source controls mapped|1 target controls covered
12%
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
3 source controls mapped|1 target controls covered
12%
WCO SAFE Framework of Standards to Secure and Facilitate Global Trade (2021)
3 source controls mapped|1 target controls covered
12%
Customs-Trade Partnership Against Terrorism (C-TPAT)
3 source controls mapped|1 target controls covered
12%
EU Critical Raw Materials Act (Regulation (EU) 2024/1252)
3 source controls mapped|1 target controls covered
12%
EU Chips Act (Regulation (EU) 2023/1781)
3 source controls mapped|1 target controls covered
12%
ASIC Cyber Resilience Good Practices
3 source controls mapped|1 target controls covered
12%
Russia Federal Law on Personal Data (152-FZ)
3 source controls mapped|1 target controls covered
12%
Colorado Privacy Act (CPA)
3 source controls mapped|4 target controls covered
12%
Lebanon Electronic Transactions and Personal Data Protection Law (Law No. 81/2018)
3 source controls mapped|2 target controls covered
12%
Wisconsin Data Privacy Act (SB 670)
3 source controls mapped|3 target controls covered
12%
Tennessee Information Protection Act (TIPA)
3 source controls mapped|2 target controls covered
12%
TEFCA — Trusted Exchange Framework and Common Agreement
3 source controls mapped|2 target controls covered
12%
USMCA Chapter 19 — Digital Trade (United States-Mexico-Canada Agreement)
3 source controls mapped|1 target controls covered
12%
US Consumer Product Safety Commission (CPSC) — Connected Product Safety
3 source controls mapped|1 target controls covered
12%
Vermont Artificial Intelligence and Consumer Data Act (AICDA)
3 source controls mapped|2 target controls covered
12%
US Gramm-Leach-Bliley Act (GLBA) — Higher Education Safeguards Rule
3 source controls mapped|3 target controls covered
12%
HIPAA Security Rule
3 source controls mapped|3 target controls covered
12%
FIDO2 and W3C WebAuthn Standard
3 source controls mapped|3 target controls covered
12%
RFC 2350 — Expectations for Computer Security Incident Response (BCP 21)
3 source controls mapped|1 target controls covered
12%
NIST Privacy Framework Version 1.0
3 source controls mapped|1 target controls covered
12%
UK Open Banking Standard
3 source controls mapped|3 target controls covered
12%
EU PSD3 and Payment Services Regulation (Proposed)
3 source controls mapped|3 target controls covered
12%
NIST SP 800-124 Rev 2 — Mobile Device Security
3 source controls mapped|1 target controls covered
12%
IACS Unified Requirements E26/E27 — Cyber Resilience of Ships and On-Board Systems
3 source controls mapped|1 target controls covered
12%
GLI-33 — Gaming Laboratories International Event Wagering Systems
3 source controls mapped|1 target controls covered
12%
FIDO2 / WebAuthn — Passwordless Authentication Standard
3 source controls mapped|3 target controls covered
12%
FTC GLBA Safeguards Rule (16 CFR Part 314)
3 source controls mapped|1 target controls covered
12%
Florida Digital Bill of Rights (SB 262)
3 source controls mapped|2 target controls covered
12%
CCSDS 350.0-G-3 — Space Communications Security (Consultative Committee for Space Data Systems)
3 source controls mapped|3 target controls covered
12%
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)
3 source controls mapped|1 target controls covered
12%
FTC Safeguards Rule (16 CFR Part 314)
3 source controls mapped|1 target controls covered
12%
W3C Verifiable Credentials (VC) Data Model 2.0
3 source controls mapped|3 target controls covered
12%
IRS Publication 1075 — Tax Information Security Guidelines
3 source controls mapped|1 target controls covered
12%
EU Maritime Single Window Environment Regulation (EU 2019/1239) and EMSA Cybersecurity
3 source controls mapped|1 target controls covered
12%
Regional Comprehensive Economic Partnership (RCEP) — E-Commerce Chapter
3 source controls mapped|1 target controls covered
12%
EU European Health Data Space (EHDS)
3 source controls mapped|1 target controls covered
12%
Digital Economy Partnership Agreement (DEPA)
3 source controls mapped|1 target controls covered
12%
WCAG 2.2
3 source controls mapped|2 target controls covered
12%
US EPA Safe Drinking Water Act (SDWA) — Cybersecurity Requirements
3 source controls mapped|1 target controls covered
12%
PAS 1192-5:2015 — Security-Minded Approach to BIM and Digital Built Environments
3 source controls mapped|2 target controls covered
12%
Canada ITSG-33 — IT Security Risk Management
3 source controls mapped|2 target controls covered
12%
New Zealand Information Security Manual (NZISM)
3 source controls mapped|2 target controls covered
12%
MARS-E — Minimum Acceptable Risk Standards for Exchanges
3 source controls mapped|2 target controls covered
12%
South Korea Cloud Security Assurance Program (CSAP)
3 source controls mapped|2 target controls covered
12%
NRC 10 CFR 73.54 — Nuclear Facility Cybersecurity
3 source controls mapped|2 target controls covered
12%
US Executive Order 14028 — Improving the Nation's Cybersecurity
3 source controls mapped|1 target controls covered
12%
ITU-T X.805 — Security Architecture for End-to-End Communications
3 source controls mapped|1 target controls covered
12%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
3 source controls mapped|1 target controls covered
12%
EN 301 549 — ICT Accessibility Requirements
3 source controls mapped|1 target controls covered
12%
Compare CWE Top 25 Most Dangerous Software Weaknesses (2024) with OWASP API Security Top 10:2023

Frequently Asked Questions

What is CWE Top 25 Most Dangerous Software Weaknesses (2024)?

CWE Top 25 Most Dangerous Software Weaknesses (2024) is a compliance framework from International with 6 domains and 25 controls. The 2024 CWE Top 25 Most Dangerous Software Weaknesses published by MITRE Corporation and supported by CISA. Based on analysis of 31,770 CVE records scored by frequency multiplied by severity (CVSS). Identifies the most common and impactful software weaknesses that developers and organizations should prioritize. Released November 19, 2024. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CWE Top 25 Most Dangerous Software Weaknesses (2024) have?

CWE Top 25 Most Dangerous Software Weaknesses (2024) has 25 controls organised across 6 domains. The largest domains are Injection and Input Validation (7 controls), Memory Safety (6 controls), Authorization and Authentication (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CWE Top 25 Most Dangerous Software Weaknesses (2024) map to?

CWE Top 25 Most Dangerous Software Weaknesses (2024) maps to 223 other compliance frameworks. The top mapping partners are OWASP API Security Top 10:2023 (24% coverage), Cyber Essentials Plus (24% coverage), CSA STAR (Security, Trust, Assurance, and Risk) (24% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with CWE Top 25 Most Dangerous Software Weaknesses (2024) compliance?

Start your CWE Top 25 Most Dangerous Software Weaknesses (2024) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CWE Top 25 Most Dangerous Software Weaknesses (2024) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 692 frameworks.

Get Started Free →

Free forever — no credit card required