News & Events - 2024Right-click and copy a URL to share an article. Send feedback about this page to cwe@mitre.org. 
2024 “CWE Top 25” Now Available! November 19, 2024 | Share this article The “2024 Common Weakness Enumeration (CWE™) Top 25 Most Dangerous Software Weaknesses” (2024 CWE Top 25) is now available on the CWE website! The Top 25 highlights the most severe and prevalent weaknesses behind the 31,770 CVE® Records in this year’s dataset. Uncovering the root causes of these vulnerabilities serves as a powerful guide for investments, policies, and practices to prevent these vulnerabilities from occurring in the first place. These weaknesses lead to serious vulnerabilities in software, and an attacker can often exploit them to take control of an affected system, steal data, or prevent applications from working. What’s Changed There are several notable shifts in ranked positions of weakness types from last year’s list, including weaknesses dropping away or making their first appearance in a CWE Top 25. The 2024 Top 25’s #1 ranked weakness is CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross Site Scripting’), which regains the top position from CWE-787: Out-of-bounds Write after three years. Weaknesses moving up the rankings this year include CWE-352: Cross-Site Request Forgery (CSRF), CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-269: Improper Privilege Management, and CWE-863: Incorrect Authorization, while CWE-20: Improper Input Validation, CWE-476: NULL Pointer Dereference, CWE-190: Integer Overflow or Wraparound, and CWE-306: Missing Authentication moved down. Two weaknesses fell off the Top 25 list this year, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and CWE-276: Incorrect Default Permissions, which were replaced with CWE-400: Uncontrolled Resource Consumption and CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Visit the Key Insights page for additional information. Leveraging Real-World Data The 2024 CWE Top 25 is the first published where the CNA community directly contributed CWE mapping reviews within the dataset, leveraging their expert knowledge of the products and access to information that might not be present in the CVE Record. In general, CNAs are best positioned to provide accurate CWE mapping determinations compared to third-party analysts, as CNAs are the authority for vulnerability information within their CNA scope and those closest to the products themselves. To create the 2024 list, the CWE Program leveraged public vulnerability data containing CWE mappings and Common Vulnerability Scoring System (CVSS) scores. A formula was then applied to the data to score each weakness based on prevalence and severity. The 2024 CWE Top 25 leverages CVE Records for vulnerabilities published between June 1, 2023, and June 1, 2024. A scoring formula is used to calculate a ranked order of weaknesses by combining the frequency that a CWE is the root cause of a vulnerability with the average severity of each of those vulnerabilities as measured by CVSS. For more information about how the list was created and the ranking methodology, visit the Methodology page. Also, be sure to also check out the CWE Top 25 page going forward for additional articles and insight. Over the coming weeks and months, the CWE Program will continue publishing further analyses to help illustrate how root cause mapping and vulnerability management plays an important role in shifting the balance of cybersecurity risk. These will include but may not be limited to the following:
Feedback Welcome Please send any feedback or questions to the CWE Research email discussion list, CWE on X, CWE page on LinkedIn, or contact us directly. CWE Version 4.16 Now Available November 19, 2024 | Share this article CWE Version 4.16 has been posted on the CWE List page to add support for the recently released “2024 CWE Top 25 Most Dangerous Software Weaknesses” list, to add 1 new artificial intelligence (AI)-related weakness, and usability improvements to 14 additional weakness entry pages, among other updates. A detailed report is available that lists specific changes between Version 4.15 and Version 4.16. Main Changes CWE 4.16 includes the addition of 1 new view to support the release of the 2024 CWE Top 25. The software weakness types included in the 2024 CWE Top 25 also include observed examples drawn from the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog to show relevance to real-world exploits. This release also includes 1 new AI-related weakness for “Improper Neutralization of Input Used for LLM Prompting.” The CWE Program thanks the members of the Artificial Intelligence Working Group (AI WG) for their collaboration preparing for this new version. One new view added: One new AI-related weakness added:
Usability Improvements
Schema Changes There were no schema updates. Summary There are 940 weaknesses and a total of 1,429 entries on the CWE List. Changes for the new version include the following:
See the complete list of changes at https://cwe.mitre.org/data/reports/diff_reports/v4.15_v4.16.html. Future updates will be noted here, on the CWE Research email discussion list, CWE page on LinkedIn, on CWE on X, and on CWE on Mastodon. Please contact us with any comments or concerns. “Leveraging Hardened Cybersecurity Frameworks for AI Security through the Common Weakness Enumeration (CWE)” October 3, 2024 | Share this article “Leveraging Hardened Cybersecurity Frameworks for AI Security through the Common Weakness Enumeration (CWE)” is the title and main topic of a September 10, 2024 blog article by CWE AI Working Group Co-Chair Kate Farris and WG member Alie Fordyce on the Robust Intelligence Blog. The authors state: “With CWE’s recent expansion into AI to address the growing need for standardized identification and categorization of weaknesses specific to artificial intelligence systems, the CWE AI Working Group assembled experts from various technical fields across industry and government ... Through these efforts, new AI-related CWEs were published in the CWE 4.15 July release. CWE-1426 highlights the danger of not properly validating AI-generated outputs and CWE-1039, an automated recognition mechanism with inadequate detection or handling of adversarial input perturbations, was updated as an AI-related weakness. Additionally, a new demonstrative example was published in CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') , which shows how AI outputs can be manipulated for command injection attacks. In addition, an observed example is a publicly reported vulnerability in real-world products that exhibit the weakness. New AI-related observed examples were published to several entries including SQL injection (CWE-89), path traversal (CWE-22), and code injection (CWE-94).” The authors conclude the article as follows: “Understanding the AI-security weakness that can result in an AI-related vulnerability enables engineers to mitigate them before AI model deployment, strengthening the AI pipeline and saving costs by preventing downstream effects ... As CWE continues to review AI-related submissions, future content releases are upcoming in late 2024 and early 2025.” Videos Page Added to CWE Website September 5, 2024 | Share this article A CWE Videos page has been added to the CWE website to ensure stakeholders have immediate access to the CWE Program’s most important videos and can view them directly on the CWE website. These select videos, as well as the entire collection of CWE Program videos and podcasts, will continue to be hosted on the CWE Program Channel on YouTube. New Video: “CWE: An Outsider’s Perspective (or: a Retrospective on the New Microarchitectural Weaknesses)” August 29, 2024 | Share this article In the “CWE: An Outsider’s Perspective (or: a Retrospective on the New Microarchitectural Weaknesses)” video, Scott Constable of Intel Labs discuses microarchitectural weaknesses in the CWE List that relate to transient execution, especially the four new microarchitectural weakness entries added with the release of CWE Version 4.14:
The video is now available on the CWE YouTube Channel. Or, watch below: This talk was presented to the Hardware CWE Special Interest Group (HW CWE SIG) on March 8, 2024. CWE REST API Now Available August 8, 2024 | Share this article The CWE™ Program is pleased to announce that the “CWE REST API” is now available. We thank the REST API Working Group for their collaboration in developing the API. The CWE REST API enables program partners in vulnerability management as well as software (SW) and hardware (HW) developers and architects, electronic design automation (EDA) tool developers, verification engineers, and others who are concerned about mitigating security risks in their products an easy and efficient way to stay up to date with CWE content. We expect this API to be a major improvement for leveraging CWE content changes as it is always up to date when requested by downstream applications and provided using a JSON representation. Accessing the CWE REST API The root URL to access the CWE REST API, which is available without any need to register or use any credentials, is available here. We suggest using the API to populate a cache of the CWE content locally, which can be refreshed whenever a new release becomes available. Documentation, Available Endpoints, and More To view the API documentation, a list of endpoints, as well as several example endpoint URLs, please visit the “Quick Start Instructions for CWE REST API Users” on GitHub. Please email us at cwe@mitre.org with any comments or concerns. CWE Version 4.15 Now Available July 16, 2024 | Share this article CWE Version 4.15 has been posted on the CWE List page and includes a number of exciting updates. There is 1 new weakness entry related to artificial intelligence (AI), CWE-1426: Improper Validation of Generative AI Output; 1 new AI-related demonstrative example added to CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'); and observed examples added to multiple CWEs related to AI/ML and generative AI prompts, including one example of “prompt injection.” The schema was updated to add AI/ML as an applicable platform to various CWEs. This release also includes the first installment of major usability improvements that are underway to enhance the understandability, navigability, and usability of CWE content (see “CWE Program Embarks on Improving Usability” for details). While this release includes upgrades to a selection of CWE Entry pages (see below), future releases will include other improvements. The CWE Program thanks the Artificial Intelligence Working Group (AI WG) and CWE User Experience Working Group (UEWG) for their collaboration preparing for this new version. Main Changes New Weakness Entry:
New Demonstrative Example:
New Observed Examples:
Usability Improvements
A detailed report is available that lists specific changes between Version 4.14 and Version 4.15. The schema was updated to version 7.2 to add AI/ML to the TechnologyNameEnumeration simpleType and to add the Diagram attribute to the Weakness element to support images in the Description element. Summary There are 939 weaknesses and a total of 1,427 entries on the CWE List. Changes for the new version include the following:
See the complete list of changes at https://cwe.mitre.org/data/reports/diff_reports/v4.14_v4.15.html. Future updates will be noted here, on the CWE Research email discussion list, CWE page on LinkedIn, on @cwecapec on X (formerly Twitter), and on @CWE_Program on Mastodon. Please contact us with any comments or concerns. CWE Program Embarks on Improving Usability July 16, 2024 | Share this article In a significant step towards enhancing usability, the CWE Program, in collaboration with the CWE User Experience Working Group (UEWG) and the Root Cause Mapping Working Group (RCM WG), will be introducing a series of comprehensive improvements in upcoming CWE releases. The improvements aim to enhance the understandability, navigability, and usability of all CWE content. There are two main thrusts to the usability improvements, referred to as “macro-level” and “micro-level” improvements:
Some micro-level improvements were implemented with the release of CWE 4.15, while macro-level improvements will be implemented in the future. A complete list of the micro-level improvements is noted in the “CWE Version 4.15 Now Available” news article, a visual example of which, is included below. A before (on the left) and after (on the right) example of the micro-level CWE entry page usability improvements is available below. Note that these images show only the tops of the CWE Entry page, using CWE-798 as the example. Sections of the entry that are not shown above will continue to be included on the entry page but are omitted here for brevity.
Feedback about these improvements is welcome at cwe@mitre.org. Join the Artificial Intelligence Working Group! June 10, 2024 | Share this article Several CWE™ Program and CVE® Program community stakeholders have established the Artificial Intelligence Working Group (AI WG) to identify and address gaps in the CWE corpus where AI-related weaknesses are not adequately covered, and work collaboratively to fix them. The AI WG is accepting new members. If you are interested in participating, please email us at cwe@mitre.org. CWE Blog: “Major Usability Improvements to Viewing CWE Content Underway” June 10, 2024 | Share this article The CWE Program is currently in the process of making changes to the presentation of CWE entries on the CWE website and have prepared a set of usability mockups as a preview for the community. These mockups are available now in our “Major Usability Improvements to Viewing CWE Content Underway” blog article on the CWE Blog on Medium. We are inviting you to provide your feedback early in our working process so that we can incorporate your valuable insights and suggestions. The changes we are proposing are focused on presenting important and concise text first for easy digestion by the reader. The article, and before and after mockup images, are here. Videos of the Two CWE-Focused Sessions at VulnCon 2024 Now Available May 13, 2024 | Share this article Videos of the two CWE-focused sessions — “The CWE Program: Current State and Road Ahead” (presentation) and “Enabling Accurate, Decentralized Root Cause Mapping at Scale” (discussion panel) — from CVE/FIRST VulnCon 2024 are now available on the CWE YouTube Channel. Or, watch below: New CWE Board Member from NVIDIA April 18, 2024 | Share this article Deana O’Meara of NVIDIA has joined the CWE Board. Through open and collaborative discussions, CWE Board members provide critical input regarding domain coverage, coverage goals, operating structure, and strategic direction. Members include technical implementers that provide input and guidance regarding the creation, design, review, maintenance, and applications of CWE entries; subject matter experts who are domain experts in weakness and/or attack pattern fields and represent a significant constituency related to, or affected by, CWE; and advocates who actively support and promote CWE throughout the community in a highly visible and responsible manner. Join the “Root Cause Mapping” Working Group! April 10, 2024 | Share this article Several CWE™ Program and CVE® Program stakeholder organizations — Intel, Microsoft, Red Hat, Rapid 7, CISA, HSSEDI — have established the Root Cause Mapping Working Group (RCM WG) focused on identifying the capabilities, processes, and information needed to improve and scale accurate root cause mapping of vulnerabilities. “Root cause mapping” is the identification of the underlying cause(s) of a vulnerability. Accurate and precise root cause mapping is valuable because it directly illuminates where investments, policy, and practices can address the root causes responsible for vulnerabilities so that they can be eliminated. This applies to both industry and government decision makers. RCM WG efforts will include:
The RCM WG is accepting new members. If you are interested in participating, please email us at cwe@mitre.org. Microsoft Announces It Will Use CWE for Root Cause Mapping of Its CVEs April 10, 2024 | Share this article On April 8, 2024, Microsoft announced in a Microsoft Security Response Center blog article entitled “Toward greater transparency: Adopting the CWE standard for Microsoft CVEs” that it will now “publish root cause data for Microsoft CVEs using the Common Weakness Enumeration (CWE™) industry standard.” In addition to explaining how Microsoft will use CWE, along with providing an example of Microsoft CVE Record with CWE information (i.e., in CVE Record CVE-2024-29990, when viewing the JSON for this record), blog author Lisa Olson, Senior Program Manager Security Release at Microsoft, states: “We believe adopting CWE will better serve our customers, developers, and security practitioners across the industry. This standard will facilitate more effective community discussions about finding and mitigating these weaknesses in existing software and hardware, while also minimizing them in future updates and releases. Ultimately, our commitment to CWE represents a meaningful step toward a more cyber-secure world.” Read the complete “Toward greater transparency: Adopting the CWE standard for Microsoft CVEs” article on the Microsoft website. CWE Program Updates Guidance for the “Root Cause Mapping” of Vulnerabilities March 22, 2024 | Share this article The CWE Program has updated its guidance for mapping the root cause(s) of vulnerabilities on the “Root Cause Mapping Guidance” page on the CWE website. Importance of Root Cause Mapping “Root cause mapping” is the identification of the underlying cause(s) of a vulnerability. Accurate and precise root cause mapping is valuable because it directly illuminates where investments, policy, and practices can address the root causes responsible for vulnerabilities so that they can be eliminated. This applies to both industry and government decision makers. Additionally, it enables:
Today, however, root cause mapping is not done accurately at scale by the vulnerability management ecosystem. The CWE Program’s new and improved guidance addresses this problem. New and Improved Guidance for Root Cause Mapping Root cause mapping is best accomplished by correlating CVE Records and/or bug or vulnerability tickets with CWE entries. The new and improved guidance provides an overview and step-by-step methodologies for mapping CVEs to CWEs. This guidance is intended to help CVE Numbering Authorities (CNAs) and those who produce or analyze CVE Records. It is also likely to be helpful to those who are analyzing vulnerabilities that are not tracked by the CVE Program. View the new and improved root cause mapping guidance here. Working Group Several CVE and CWE stakeholder organizations have established a working group focused on identifying the capabilities, processes, and information needed to improve and scale accurate root cause mapping. Efforts include:
If you are interested in participating, please email us at cwe@mitre.org. CWE at CVE/FIRST VulnCon 2024 March 22, 2024 | Share this article CWE was the main focus of two sessions at CVE/FIRST VulnCon 2024 at the McKimmon Center in Raleigh, North Carolina, USA, held March 25-27, 2024:
Thank you so much to everyone who attended our RCM discussion panel and CWE talk at the first-ever VulnCon conference. We are already looking forward to next year’s event! CWE Version 4.14 Now Available February 29, 2024 | Share this article CWE Version 4.14 has been posted on the CWE List page and includes a number of exciting updates. There are 4 new weakness entries related to related to hardware micro architectures; 1 new View for “Weaknesses Addressed by ISA/IEC 62443 Requirements” for industrial automation and control systems; updates to observed and demonstrative examples; 10 new demonstrative examples from the HACK@DAC security challenge contest; among other changes. Also, a major enhancement has been made to CWE entry pages beginning with this release. All CWE entry web pages will now have vulnerability mapping labels underneath their titles. These include labels for when a CWE is approved, discouraged, or prohibited from vulnerability root cause mapping. In addition, the labels provide a direct link to the entry’s Mapping Notes for quick reference to more detailed information. The CWE Program thanks Intel, AMD, ARM, Cycuity, Riscure, HACK@DAC contributors from Texas A&M University and Technical University of Darmstadt, and members of the CWE ICS/OT Special Interest Group (ICS/OT SIG) and Hardware CWE Special Interest Group (HW CWE SIG) for their collaboration preparing for this new version. Main Changes 4 New Weakness Entries Related to Hardware Micro Architectures:
1 New View:
New and Updated Observed Examples:
New and Updated Demonstrative Examples:
A detailed report is available that lists specific changes between Version 4.13 and Version 4.14. There were no schema updates. Summary There are 938 weaknesses and a total of 1,426 entries on the CWE List. Changes for the new version include the following:
See the complete list of changes at https://cwe.mitre.org/data/reports/diff_reports/v4.13_v4.14.html. Future updates will be noted here, on the CWE Research email discussion list, CWE page on LinkedIn, on @cwecapec on X (formerly Twitter), and on @CWE_Program on Mastodon. Please contact us with any comments or concerns. CWE Podcast: “Red Hat’s CWE Journey” January 18, 2024 | Share this article “Out-Of-Bounds Read” is the CWE Program’s free podcast about common weaknesses in software and hardware, the vulnerabilities they cause, how to reduce them, and how using CWE can help make products more secure by design. In our latest episode, CWE Program Lead Alec Summers talks with Red Hat’s Przemyslaw Roguski, CWE Technical Lead Steve Christey, and CWE Top 25 Lead Connor Mullaly, about Common Weakness Enumeration (CWE™) and the problem it solves; how Red Hat’s experience and relationship with CWE began and developed over time; how Red Hat uses CWE today, especially “CWE-699: Software Development”; how CWE’s different “views” can be used to educate and enable new and/or existing CWE users; CWE mappings and why mapping to CWEs/root cause weaknesses is important in vulnerability disclosure; the CWE Top 25 list; CWE in the software development lifecycle; how ongoing development of CWE benefits users; and more. 
Additional details about Red Hat’s ongoing use of CWE are included in these two articles on the Red Hat blog, “Red Hat’s CWE journey” and “Weakness risk-patterns: A Red Hat way to identify poor software practices in the secure development lifecycle.” The podcast is available for free on the CWE Program Channel on YouTube. Please give our latest episode a listen and let us know what you think by commenting on YouTube, X-Twitter, LinkedIn, Mastodon, or by email. We look forward to hearing from you! |
