Compliance Framework

CWE Top 25 — the most dangerous software weaknesses.

The CWE Top 25 Most Dangerous Software Weaknesses identifies the software defects most frequently exploited to compromise systems. MergeGuide ships with detection rules covering all 25 weaknesses — enforcing them across all 14 supported languages from the first line of code.

CWE and the vulnerability catalog

The Common Weakness Enumeration (CWE) is a community-developed list of software and hardware weakness types, maintained by MITRE. The CWE Top 25 is compiled annually from CVE data — representing the weaknesses that produce the most real-world exploits across all software categories.

Unlike OWASP (which focuses on web applications), CWE Top 25 covers weaknesses across all software types including systems software, embedded systems, and enterprise applications. It's referenced by NIST NVD, CISA KEV, and used by security researchers globally as the canonical weakness taxonomy.

MergeGuide's Free tier includes full CWE Top 25 detection — bundled with OWASP Top 10 coverage in the baseline tier. 106 Semgrep rules and 237 regex patterns enforce CWE Top 25 across all 14 supported languages with no subscription required.

Top CWE categories covered

  • CWE-787 — Out-of-bounds Write: detecting unsafe memory operations
  • CWE-79 — Cross-site Scripting: detecting unsanitized output rendering
  • CWE-89 — SQL Injection: detecting unparameterized database queries
  • CWE-416 — Use After Free: detecting unsafe memory management patterns
  • CWE-78 — OS Command Injection: detecting unsanitized shell execution
  • CWE-20 — Improper Input Validation: detecting missing validation on inputs
  • CWE-125 — Out-of-bounds Read: detecting unsafe buffer access patterns
  • CWE-22 — Path Traversal: detecting user-controlled file path operations
  • CWE-352 — Cross-Site Request Forgery: detecting missing CSRF protections
  • CWE-434 — Unrestricted File Upload: detecting unsafe file handling

CWE Top 25 detection patterns

CWE ID What MergeGuide Detects Severity
CWE-89 — SQL InjectionUnparameterized database queries concatenating user-controlled inputCritical
CWE-79 — XSSUser-controlled data rendered in HTML output without encodingCritical
CWE-78 — OS Command InjectionShell execution calls with unsanitized arguments from user inputCritical
CWE-798 — Hardcoded CredentialsPasswords, API keys, and secrets embedded in source codeCritical
CWE-22 — Path TraversalFile system operations with user-controlled path componentsHigh
CWE-352 — CSRFState-changing endpoints missing CSRF token validationHigh
CWE-434 — Unrestricted UploadFile upload handlers without type or size validationHigh
🆓

Free tier baseline

Full CWE Top 25 detection is included in MergeGuide's Free tier alongside OWASP Top 10. Every developer gets detection coverage for the most exploited software weaknesses with no subscription required — because baseline security shouldn't be a paid feature.

🔗

CVE and KEV alignment

CWE Top 25 is compiled from CVE data and aligns directly with CISA's Known Exploited Vulnerabilities catalog. MergeGuide's detection rules target the code patterns that produce these weaknesses — preventing the bugs that become CVEs before they ship.

🌐

Cross-language coverage

CWE Top 25 weaknesses appear across all programming languages. MergeGuide's detection rules cover all 25 weaknesses across 14 languages — Go, Python, JavaScript, TypeScript, Java, C#, Ruby, PHP, Swift, Kotlin, Rust, C/C++, Terraform, and Dockerfile.

Eliminate the most exploited weaknesses from your codebase.

Start free — full CWE Top 25 and OWASP Top 10 detection included, no credit card required.

Get Started Free Book a demo