| MemberOf | Prohibited | V | 1400 | Comprehensive Categorization for Software Assurance Trends |
| HasMember | Discouraged | C | 118 | Incorrect Access of Indexable Resource ('Range Error') |
| HasMember | Prohibited | V | 1042 | Static Member Data Element outside of a Singleton Class Element |
| HasMember | Allowed | B | 1046 | Creation of Immutable Text Using String Concatenation |
| HasMember | Allowed | B | 1049 | Excessive Data Query Operations in a Large Data Table |
| HasMember | Allowed | B | 1050 | Excessive Platform Resource Consumption within a Loop |
| HasMember | Prohibited | B | 1051 | Initialization with Hard-Coded Network Resource Configuration Data |
| HasMember | Allowed | B | 1052 | Excessive Use of Hard-Coded Literals in Initialization |
| HasMember | Prohibited | B | 1063 | Creation of Class Instance within a Static Code Block |
| HasMember | Allowed | B | 1067 | Excessive Execution of Sequential Searches of Data Resource |
| HasMember | Prohibited | B | 1072 | Data Resource Access without Use of Connection Pooling |
| HasMember | Prohibited | B | 1073 | Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses |
| HasMember | Prohibited | B | 1084 | Invokable Control Element with Excessive File or Data Access Operations |
| HasMember | Allowed | B | 1089 | Large Data Table with Excessive Number of Indices |
| HasMember | Allowed | B | 1091 | Use of Object without Invoking Destructor Method |
| HasMember | Prohibited | B | 1094 | Excessive Index Range Scan for a Data Resource |
| HasMember | Allowed-with-Review | C | 1176 | Inefficient CPU Computation |
| HasMember | Allowed | B | 1188 | Initialization of a Resource with an Insecure Default |
| HasMember | Allowed | B | 1221 | Incorrect Register Defaults or Module Parameters |
| HasMember | Allowed-with-Review | C | 1229 | Creation of Emergent Resource |
| HasMember | Allowed | B | 1235 | Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations |
| HasMember | Allowed | V | 1239 | Improper Zeroization of Hardware Register |
| HasMember | Allowed | B | 1246 | Improper Write Handling in Limited-write Non-Volatile Memories |
| HasMember | Allowed | B | 1250 | Improper Preservation of Consistency Between Independent Representations of Shared State |
| HasMember | Allowed | B | 1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information |
| HasMember | Allowed | B | 1266 | Improper Scrubbing of Sensitive Data from Decommissioned Device |
| HasMember | Allowed | B | 1271 | Uninitialized Value on Reset for Registers Holding Security Settings |
| HasMember | Allowed | B | 1272 | Sensitive Information Uncleared Before Debug/Power State Transition |
| HasMember | Allowed | B | 1279 | Cryptographic Operations are run Before Supporting Units are Ready |
| HasMember | Allowed | B | 1301 | Insufficient or Incomplete Data Removal within Hardware Component |
| HasMember | Allowed | B | 1325 | Improperly Controlled Sequential Memory Allocation |
| HasMember | Allowed | V | 1330 | Remanent Data Readable after Memory Erase |
| HasMember | Allowed | B | 1333 | Inefficient Regular Expression Complexity |
| HasMember | Allowed | B | 1342 | Information Exposure through Microarchitectural State after Transient Execution |
| HasMember | Allowed | B | 1386 | Insecure Operation on Windows Junction / Mount Point |
| HasMember | Allowed | B | 1389 | Incorrect Parsing of Numbers with Different Radices |
| HasMember | Allowed-with-Review | C | 1419 | Incorrect Initialization of Resource |
| HasMember | Allowed-with-Review | B | 1420 | Exposure of Sensitive Information during Transient Execution |
| HasMember | Allowed | B | 1421 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution |
| HasMember | Allowed | B | 1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution |
| HasMember | Allowed | B | 1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution |
| HasMember | Allowed | B | 178 | Improper Handling of Case Sensitivity |
| HasMember | Allowed | V | 192 | Integer Coercion Error |
| HasMember | Allowed | V | 194 | Unexpected Sign Extension |
| HasMember | Allowed | V | 195 | Signed to Unsigned Conversion Error |
| HasMember | Allowed | V | 196 | Unsigned to Signed Conversion Error |
| HasMember | Allowed | B | 197 | Numeric Truncation Error |
| HasMember | Allowed | B | 212 | Improper Removal of Sensitive Information Before Storage or Transfer |
| HasMember | Allowed-with-Review | C | 221 | Information Loss or Omission |
| HasMember | Allowed | B | 226 | Sensitive Information in Resource Not Removed Before Reuse |
| HasMember | Allowed | V | 243 | Creation of chroot Jail Without Changing Working Directory |
| HasMember | Discouraged | B | 372 | Incomplete Internal State Distinction |
| HasMember | Allowed | B | 386 | Symbolic Name not Mapping to Correct Object |
| HasMember | Allowed | B | 409 | Improper Handling of Highly Compressed Data (Data Amplification) |
| HasMember | Discouraged | C | 400 | Uncontrolled Resource Consumption |
| HasMember | Allowed-with-Review | C | 404 | Improper Resource Shutdown or Release |
| HasMember | Allowed-with-Review | C | 405 | Asymmetric Resource Consumption (Amplification) |
| HasMember | Allowed-with-Review | C | 406 | Insufficient Control of Network Message Volume (Network Amplification) |
| HasMember | Allowed-with-Review | C | 407 | Inefficient Algorithmic Complexity |
| HasMember | Allowed | C | 410 | Insufficient Resource Pool |
| HasMember | Allowed | B | 434 | Unrestricted Upload of File with Dangerous Type |
| HasMember | Allowed | V | 453 | Insecure Default Variable Initialization |
| HasMember | Allowed | B | 454 | External Initialization of Trusted Variables or Data Stores |
| HasMember | Allowed | V | 456 | Missing Initialization of a Variable |
| HasMember | Allowed | V | 457 | Use of Uninitialized Variable |
| HasMember | Allowed | B | 459 | Incomplete Cleanup |
| HasMember | Allowed | B | 460 | Improper Cleanup on Thrown Exception |
| HasMember | Allowed | B | 471 | Modification of Assumed-Immutable Data (MAID) |
| HasMember | Allowed | B | 487 | Reliance on Package-level Scope |
| HasMember | Allowed | V | 495 | Private Data Structure Returned From A Public Method |
| HasMember | Allowed | V | 496 | Public Data Assigned to Private Array-Typed Field |
| HasMember | Allowed | B | 501 | Trust Boundary Violation |
| HasMember | Allowed | V | 568 | finalize() Method Without super.finalize() |
| HasMember | Allowed | V | 580 | clone() Method Without super.clone() |
| HasMember | Allowed | V | 588 | Attempt to Access Child of a Non-structure Pointer |
| HasMember | Allowed | V | 607 | Public Static Final Field References Mutable Object |
| HasMember | Discouraged | C | 610 | Externally Controlled Reference to a Resource in Another Sphere |
| HasMember | Allowed | V | 618 | Exposed Unsafe ActiveX Method |
| HasMember | Discouraged | C | 662 | Improper Synchronization |
| HasMember | Discouraged | P | 664 | Improper Control of a Resource Through its Lifetime |
| HasMember | Discouraged | C | 665 | Improper Initialization |
| HasMember | Discouraged | C | 666 | Operation on Resource in Wrong Phase of Lifetime |
| HasMember | Allowed-with-Review | C | 669 | Incorrect Resource Transfer Between Spheres |
| HasMember | Allowed-with-Review | C | 673 | External Influence of Sphere Definition |
| HasMember | Allowed | B | 681 | Incorrect Conversion between Numeric Types |
| HasMember | Allowed-with-Review | C | 704 | Incorrect Type Conversion or Cast |
| HasMember | Allowed-with-Review | C | 706 | Use of Incorrectly-Resolved Name or Reference |
| HasMember | Allowed | B | 749 | Exposed Dangerous Method or Function |
| HasMember | Allowed | B | 770 | Allocation of Resources Without Limits or Throttling |
| HasMember | Allowed | B | 771 | Missing Reference to Active Allocated Resource |
| HasMember | Allowed | B | 772 | Missing Release of Resource after Effective Lifetime |
| HasMember | Allowed | V | 773 | Missing Reference to Active File Descriptor or Handle |
| HasMember | Allowed | V | 774 | Allocation of File Descriptors or Handles Without Limits or Throttling |
| HasMember | Allowed | V | 775 | Missing Release of File Descriptor or Handle after Effective Lifetime |
| HasMember | Allowed | B | 776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
| HasMember | Allowed | B | 779 | Logging of Excessive Data |
| HasMember | Allowed | V | 782 | Exposed IOCTL with Insufficient Access Control |
| HasMember | Allowed | V | 827 | Improper Control of Document Type Definition |
| HasMember | Allowed | B | 829 | Inclusion of Functionality from Untrusted Control Sphere |
| HasMember | Allowed | V | 830 | Inclusion of Web Functionality from an Untrusted Source |
| HasMember | Allowed | B | 843 | Access of Resource Using Incompatible Type ('Type Confusion') |
| HasMember | Allowed | B | 908 | Use of Uninitialized Resource |
| HasMember | Allowed-with-Review | C | 909 | Missing Initialization of Resource |
| HasMember | Allowed | B | 911 | Improper Update of Reference Count |
| HasMember | Allowed-with-Review | C | 913 | Improper Control of Dynamically-Managed Code Resources |
| HasMember | Allowed | B | 920 | Improper Restriction of Power Consumption |
| HasMember | Allowed-with-Review | C | 922 | Insecure Storage of Sensitive Information |
| HasMember | Allowed | V | 98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') |