MITRE CWE Top 25 Most Dangerous Software Weaknesses 2024 (CWE-79 XSS, CWE-787 Out-of-bounds Write, CWE-89 SQL Injection, CWE-352 CSRF, CWE-22 Path Traversal, CWE-125, CWE-78, CWE-416, CWE-862)

What MITRE CWE Top 25 Most Dangerous Software Weaknesses 2024 (CWE-79 XSS, CWE-787 Out-of-bounds Write, CWE-89 SQL Injection, CWE-352 CSRF, CWE-22 Path Traversal, CWE-125, CWE-78, CWE-416, CWE-862) requires

The 2024 CWE Top 25 Most Dangerous Software Weaknesses, published by The MITRE Corporation's CWE program at cwe.mitre.org/top25/archive/2024/, is the ranked annual list of the most severe and prevalent software weaknesses derived from analysis of 31,770 CVE records in the 2024 dataset. The list is generated using a published methodology that scores CWEs by frequency and severity (KEV-weighted impact). The 2024 ranking is: 1 CWE-79 (XSS), 2 CWE-787 (Out-of-bounds Write), 3 CWE-89 (SQL Injection), 4 CWE-352 (CSRF), 5 CWE-22 (Path Traversal), 6 CWE-125 (Out-of-bounds Read), 7 CWE-78 (OS Command Injection), 8 CWE-416 (Use After Free), 9 CWE-862 (Missing Authorization), 10 CWE-434 (Unrestricted Upload of File with Dangerous Type), 11 CWE-94 (Code Injection), 12 CWE-20 (Improper Input Validation), 13 CWE-77 (Command Injection), 14 CWE-287 (Improper Authentication), 15 CWE-269 (Improper Privilege Management), 16 CWE-502 (Deserialization of Untrusted Data), 17 CWE-200 (Exposure of Sensitive Information), 18 CWE-863 (Incorrect Authorization), 19 CWE-918 (SSRF), 20 CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), 21 CWE-476 (NULL Pointer Dereference), 22 CWE-798 (Use of Hard-coded Credentials), 23 CWE-190 (Integer Overflow), 24 CWE-400 (Uncontrolled Resource Consumption), 25 CWE-306 (Missing Authentication for Critical Function). The CWE Top 25 is the canonical reference used by application security programs, secure SDLC requirements, the OWASP Top 10 cross-walk, the PCI Software Security Framework, and federal software-supply-chain policy (NIST SSDF, EO 14028, Memo M-22-18) to prioritise remediation and secure-coding training.

Pillar: Cybersecurity · Authority: The MITRE Corporation (CWE Program); CISA sponsor · Version: 1.0.0 · Last updated: 2026-06-03

Primary source: https://cwe.mitre.org/top25/archive/2024/2024_top25_list.html

SHA-256 integrity: 2ca30503a85db8e9c88ae8b268e8ca9f60a4fbcb11acce6d1e3f75a505e5cdb9

Primary Citations — 7 traced to source

• 2024 CWE Top 25 Most Dangerous Software Weaknesses, MITRE Corporation, published at cwe.mitre.org/top25/archive/2024/; the list 'highlights the most severe and prevalent weaknesses behind the 31,770 Common Vulnerabilities and Exposures (CVE) Records in this year's dataset.'
• Top 5 ranked weaknesses: 1 CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting); 2 CWE-787 Out-of-bounds Write; 3 CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection); 4 CWE-352 Cross-Site Request Forgery (CSRF); 5 CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal).

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-cwe-top-25-2024-most-dangerous-weaknesses.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-cwe-top-25-2024-most-dangerous-weaknesses.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-cwe-top-25-2024-most-dangerous-weaknesses
• Back to registry: Browse all 10,085 compliance nodes