Weaknesses

Weaknesses (CWE) behind CISA KEV entries

Which kinds of mistake lead to exploited vulnerabilities. An entry can list several CWEs, so shares add up to more than 100%.

Catalog: 2026.10.30
CWEs: 198
Entries without CWE: 175

Answer KEV entries list 198 distinct CWEs. The most common is CWE-20 (Improper input validation) on 119 entries, 6.7% of the catalog. 175 entries list no CWE.

TTop 15

Top 15 CWEs by KEV entries
CWE	Entries	Share of catalog
CWE-20 Improper input validation	119	6.7%
CWE-78 OS command injection	113	6.4%
CWE-787 Out-of-bounds write	106	6%
CWE-416 Use after free	95	5.4%
CWE-119 Memory buffer bounds error	88	5%
CWE-22 Path traversal	82	4.6%
CWE-94 Code injection	72	4.1%
CWE-502 Unsafe deserialization	71	4%
CWE-287 Improper authentication	48	2.7%
CWE-306 Missing authentication	43	2.4%
CWE-843 Type confusion	38	2.2%
CWE-284 Improper access control	37	2.1%
CWE-77 Command injection	33	1.9%
CWE-79 Cross-site scripting (XSS)	33	1.9%
CWE-89 SQL injection	33	1.9%

AAll weaknesses

All 198 CWEs listed in CISA KEV
CWE	Name	Rank	Entries	Share	Vendors
CWE-20	Improper input validation	1	119	6.7%	42
CWE-78	OS command injection	2	113	6.4%	68
CWE-787	Out-of-bounds write	3	106	6%	21
CWE-416	Use after free	4	95	5.4%	13
CWE-119	Memory buffer bounds error	5	88	5%	18
CWE-22	Path traversal	6	82	4.6%	56
CWE-94	Code injection	7	72	4.1%	38
CWE-502	Unsafe deserialization	8	71	4%	36
CWE-287	Improper authentication	9	48	2.7%	32
CWE-306	Missing authentication	10	43	2.4%	30
CWE-843	Type confusion	11	38	2.2%	6
CWE-284	Improper access control	12	37	2.1%	23
CWE-77	Command injection	13	33	1.9%	22
CWE-79	Cross-site scripting (XSS)	14	33	1.9%	15
CWE-89	SQL injection	15	33	1.9%	25
CWE-122	Heap-based buffer overflow	16	33	1.9%	13
CWE-264	Permissions and access controls (category)	17	31	1.8%	8
CWE-200	Information exposure	18	25	1.4%	15
CWE-434	Unrestricted file upload	19	24	1.4%	22
CWE-918	Server-side request forgery	20	24	1.4%	15
CWE-288	Authentication bypass via alternate path	21	21	1.2%	13
CWE-269	Improper privilege management	22	19	1.1%	10
CWE-399	Resource management errors (category)	23	18	1%	3
CWE-863	Incorrect authorization	24	18	1%	15
CWE-59	Link following	25	17	1%	4
CWE-125	Out-of-bounds read	26	17	1%	9
CWE-190	Integer overflow	27	17	1%	8
CWE-862	Missing authorization	28	13	0.7%	11
CWE-74	Injection	29	12	0.7%	10
CWE-120	Classic buffer overflow	30	12	0.7%	9
CWE-121	Stack-based buffer overflow	31	12	0.7%	8
CWE-362	Race condition	32	12	0.7%	7
CWE-693	Protection mechanism failure	33	11	0.6%	4
CWE-23	Relative path traversal	34	10	0.6%	8
CWE-506	see MITRE	35	8	0.5%	8
CWE-611	XML external entity (XXE)	36	8	0.5%	7
CWE-798	Hard-coded credentials	37	8	0.5%	8
CWE-138	see MITRE	38	7	0.4%	5
CWE-290	see MITRE	39	7	0.4%	7
CWE-73	see MITRE	40	6	0.3%	4
CWE-95	Eval injection	41	6	0.3%	6
CWE-189	see MITRE	42	6	0.3%	3
CWE-347	see MITRE	43	6	0.3%	6
CWE-352	Cross-site request forgery	44	6	0.3%	6
CWE-404	see MITRE	45	6	0.3%	1
CWE-36	see MITRE	46	5	0.3%	3
CWE-88	see MITRE	47	5	0.3%	5
CWE-276	Incorrect default permissions	48	5	0.3%	4
CWE-295	see MITRE	49	5	0.3%	4
CWE-367	see MITRE	50	5	0.3%	4
CWE-400	Uncontrolled resource consumption	51	5	0.3%	4
CWE-755	see MITRE	52	5	0.3%	4
CWE-822	see MITRE	53	5	0.3%	1
CWE-917	see MITRE	54	5	0.3%	3
CWE-1188	see MITRE	55	5	0.3%	3
CWE-116	see MITRE	56	4	0.2%	4
CWE-158	see MITRE	57	4	0.2%	4
CWE-184	see MITRE	58	4	0.2%	4
CWE-326	see MITRE	59	4	0.2%	3
CWE-415	Double free	60	4	0.2%	4
CWE-444	see MITRE	61	4	0.2%	3
CWE-494	see MITRE	62	4	0.2%	4
CWE-522	see MITRE	63	4	0.2%	4
CWE-552	see MITRE	64	4	0.2%	4
CWE-754	see MITRE	65	4	0.2%	3
CWE-19	see MITRE	66	3	0.2%	2
CWE-80	see MITRE	67	3	0.2%	2
CWE-134	see MITRE	68	3	0.2%	3
CWE-250	see MITRE	69	3	0.2%	2
CWE-285	Improper authorization	70	3	0.2%	3
CWE-427	see MITRE	71	3	0.2%	2
CWE-807	see MITRE	72	3	0.2%	2
CWE-824	see MITRE	73	3	0.2%	2
CWE-908	see MITRE	74	3	0.2%	3
CWE-912	see MITRE	75	3	0.2%	3
CWE-1220	see MITRE	76	3	0.2%	1
CWE-1336	see MITRE	77	3	0.2%	3
CWE-1386	see MITRE	78	3	0.2%	1
CWE-1390	see MITRE	79	3	0.2%	1
CWE-25	see MITRE	80	2	0.1%	2
CWE-35	see MITRE	81	2	0.1%	2
CWE-96	see MITRE	82	2	0.1%	2
CWE-98	see MITRE	83	2	0.1%	2
CWE-191	see MITRE	84	2	0.1%	2
CWE-209	see MITRE	85	2	0.1%	2
CWE-255	see MITRE	86	2	0.1%	2
CWE-259	see MITRE	87	2	0.1%	2
CWE-282	see MITRE	88	2	0.1%	2
CWE-303	see MITRE	89	2	0.1%	2
CWE-305	see MITRE	90	2	0.1%	2
CWE-420	see MITRE	91	2	0.1%	2
CWE-425	see MITRE	92	2	0.1%	2
CWE-426	see MITRE	93	2	0.1%	1
CWE-436	see MITRE	94	2	0.1%	2
CWE-441	see MITRE	95	2	0.1%	2
CWE-451	see MITRE	96	2	0.1%	1
CWE-470	see MITRE	97	2	0.1%	2
CWE-473	see MITRE	98	2	0.1%	1
CWE-532	see MITRE	99	2	0.1%	2
CWE-591	see MITRE	100	2	0.1%	1
CWE-610	see MITRE	101	2	0.1%	2
CWE-648	see MITRE	102	2	0.1%	1
CWE-665	see MITRE	103	2	0.1%	2
CWE-667	see MITRE	104	2	0.1%	1
CWE-704	see MITRE	105	2	0.1%	2
CWE-707	see MITRE	106	2	0.1%	1
CWE-732	Incorrect permission assignment	107	2	0.1%	2
CWE-749	see MITRE	108	2	0.1%	2
CWE-823	see MITRE	109	2	0.1%	2
CWE-829	see MITRE	110	2	0.1%	2
CWE-940	see MITRE	111	2	0.1%	2
CWE-1173	see MITRE	112	2	0.1%	1
CWE-1285	see MITRE	113	2	0.1%	1
CWE-1325	see MITRE	114	2	0.1%	1
CWE-1419	see MITRE	115	2	0.1%	1
CWE-27	see MITRE	116	1	0.1%	1
CWE-39	see MITRE	117	1	0.1%	1
CWE-40	see MITRE	118	1	0.1%	1
CWE-44	see MITRE	119	1	0.1%	1
CWE-55	see MITRE	120	1	0.1%	1
CWE-61	see MITRE	121	1	0.1%	1
CWE-84	see MITRE	122	1	0.1%	1
CWE-91	see MITRE	123	1	0.1%	1
CWE-93	see MITRE	124	1	0.1%	1
CWE-114	see MITRE	125	1	0.1%	1
CWE-123	see MITRE	126	1	0.1%	1
CWE-124	see MITRE	127	1	0.1%	1
CWE-130	see MITRE	128	1	0.1%	1
CWE-131	see MITRE	129	1	0.1%	1
CWE-177	see MITRE	130	1	0.1%	1
CWE-178	see MITRE	131	1	0.1%	1
CWE-193	see MITRE	132	1	0.1%	1
CWE-197	see MITRE	133	1	0.1%	1
CWE-203	see MITRE	134	1	0.1%	1
CWE-244	see MITRE	135	1	0.1%	1
CWE-252	see MITRE	136	1	0.1%	1
CWE-254	see MITRE	137	1	0.1%	1
CWE-257	see MITRE	138	1	0.1%	1
CWE-266	see MITRE	139	1	0.1%	1
CWE-267	see MITRE	140	1	0.1%	1
CWE-273	see MITRE	141	1	0.1%	1
CWE-274	see MITRE	142	1	0.1%	1
CWE-280	see MITRE	143	1	0.1%	1
CWE-281	see MITRE	144	1	0.1%	1
CWE-294	see MITRE	145	1	0.1%	1
CWE-310	see MITRE	146	1	0.1%	1
CWE-311	see MITRE	147	1	0.1%	1
CWE-312	see MITRE	148	1	0.1%	1
CWE-321	see MITRE	149	1	0.1%	1
CWE-324	see MITRE	150	1	0.1%	1
CWE-330	see MITRE	151	1	0.1%	1
CWE-340	see MITRE	152	1	0.1%	1
CWE-345	see MITRE	153	1	0.1%	1
CWE-346	see MITRE	154	1	0.1%	1
CWE-351	see MITRE	155	1	0.1%	1
CWE-353	see MITRE	156	1	0.1%	1
CWE-357	see MITRE	157	1	0.1%	1
CWE-358	see MITRE	158	1	0.1%	1
CWE-384	see MITRE	159	1	0.1%	1
CWE-388	see MITRE	160	1	0.1%	1
CWE-390	see MITRE	161	1	0.1%	1
CWE-401	see MITRE	162	1	0.1%	1
CWE-406	see MITRE	163	1	0.1%	1
CWE-424	see MITRE	164	1	0.1%	1
CWE-456	see MITRE	165	1	0.1%	1
CWE-472	see MITRE	166	1	0.1%	1
CWE-476	NULL pointer dereference	167	1	0.1%	1
CWE-497	see MITRE	168	1	0.1%	1
CWE-521	see MITRE	169	1	0.1%	1
CWE-528	see MITRE	170	1	0.1%	1
CWE-565	see MITRE	171	1	0.1%	1
CWE-601	see MITRE	172	1	0.1%	1
CWE-639	see MITRE	173	1	0.1%	1
CWE-641	see MITRE	174	1	0.1%	1
CWE-645	see MITRE	175	1	0.1%	1
CWE-647	see MITRE	176	1	0.1%	1
CWE-653	see MITRE	177	1	0.1%	1
CWE-664	see MITRE	178	1	0.1%	1
CWE-668	see MITRE	179	1	0.1%	1
CWE-669	see MITRE	180	1	0.1%	1
CWE-690	see MITRE	181	1	0.1%	1
CWE-697	see MITRE	182	1	0.1%	1
CWE-703	see MITRE	183	1	0.1%	1
CWE-706	see MITRE	184	1	0.1%	1
CWE-772	see MITRE	185	1	0.1%	1
CWE-778	see MITRE	186	1	0.1%	1
CWE-782	see MITRE	187	1	0.1%	1
CWE-783	see MITRE	188	1	0.1%	1
CWE-785	see MITRE	189	1	0.1%	1
CWE-790	see MITRE	190	1	0.1%	1
CWE-835	see MITRE	191	1	0.1%	1
CWE-841	see MITRE	192	1	0.1%	1
CWE-913	see MITRE	193	1	0.1%	1
CWE-923	see MITRE	194	1	0.1%	1
CWE-1023	see MITRE	195	1	0.1%	1
CWE-1287	see MITRE	196	1	0.1%	1
CWE-1321	Prototype pollution	197	1	0.1%	1
CWE-1393	see MITRE	198	1	0.1%	1

Cite this

The most common weakness in CISA's KEV catalog is CWE-20 (Improper input validation), listed on 119 entries. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

`/`	Focus search
`?`	Show this panel
`Esc`	Close panel or clear search
`g` `d`	Go to Dashboard
`g` `k`	Go to KEV
`g` `v`	Go to Vendors
`g` `p`	Go to Products
`g` `w`	Go to Weaknesses
`g` `s`	Go to Stats
`g` `r`	Go to Regulations
`g` `b`	Go to Briefings