| HasMember | Allowed | V | 14 | Compiler Removal of Code to Clear Buffers |
| HasMember | Allowed | B | 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| HasMember | Allowed | B | 23 | Relative Path Traversal |
| HasMember | Allowed | B | 36 | Absolute Path Traversal |
| HasMember | Allowed | B | 41 | Improper Resolution of Path Equivalence |
| HasMember | Allowed | B | 59 | Improper Link Resolution Before File Access ('Link Following') |
| HasMember | Allowed | B | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HasMember | Allowed | B | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| HasMember | Allowed | B | 88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') |
| HasMember | Allowed | B | 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| HasMember | Allowed | B | 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') |
| HasMember | Allowed-with-Review | B | 94 | Improper Control of Generation of Code ('Code Injection') |
| HasMember | Allowed | V | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') |
| HasMember | Allowed | B | 96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') |
| HasMember | Allowed-with-Review | C | 99 | Improper Control of Resource Identifiers ('Resource Injection') |
| HasMember | Allowed | V | 113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') |
| HasMember | Allowed | B | 117 | Improper Output Neutralization for Logs |
| HasMember | Allowed-with-Review | B | 120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
| HasMember | Allowed | V | 129 | Improper Validation of Array Index |
| HasMember | Allowed | B | 131 | Incorrect Calculation of Buffer Size |
| HasMember | Allowed | B | 134 | Use of Externally-Controlled Format String |
| HasMember | Allowed | B | 135 | Incorrect Calculation of Multi-Byte String Length |
| HasMember | Allowed | B | 170 | Improper Null Termination |
| HasMember | Allowed | V | 173 | Improper Handling of Alternate Encoding |
| HasMember | Allowed | V | 174 | Double Decoding of the Same Data |
| HasMember | Allowed | V | 175 | Improper Handling of Mixed Encoding |
| HasMember | Allowed | B | 179 | Incorrect Behavior Order: Early Validation |
| HasMember | Allowed-with-Review | C | 185 | Incorrect Regular Expression |
| HasMember | Allowed | B | 190 | Integer Overflow or Wraparound |
| HasMember | Allowed | B | 191 | Integer Underflow (Wrap or Wraparound) |
| HasMember | Allowed | B | 193 | Off-by-one Error |
| HasMember | Allowed | B | 203 | Observable Discrepancy |
| HasMember | Allowed | B | 209 | Generation of Error Message Containing Sensitive Information |
| HasMember | Allowed | B | 212 | Improper Removal of Sensitive Information Before Storage or Transfer |
| HasMember | Allowed | B | 222 | Truncation of Security-relevant Information |
| HasMember | Allowed | B | 223 | Omission of Security-relevant Information |
| HasMember | Allowed-with-Review | C | 228 | Improper Handling of Syntactically Invalid Structure |
| HasMember | Allowed | V | 244 | Improper Clearing of Heap Memory Before Release ('Heap Inspection') |
| HasMember | Allowed | B | 248 | Uncaught Exception |
| HasMember | Allowed | B | 250 | Execution with Unnecessary Privileges |
| HasMember | Allowed | B | 252 | Unchecked Return Value |
| HasMember | Allowed | B | 253 | Incorrect Check of Function Return Value |
| HasMember | Allowed | B | 262 | Not Using Password Aging |
| HasMember | Allowed | B | 263 | Password Aging with Long Expiration |
| HasMember | Allowed | B | 266 | Incorrect Privilege Assignment |
| HasMember | Allowed | B | 267 | Privilege Defined With Unsafe Actions |
| HasMember | Allowed | B | 268 | Privilege Chaining |
| HasMember | Allowed | B | 270 | Privilege Context Switching Error |
| HasMember | Allowed-with-Review | C | 271 | Privilege Dropping / Lowering Errors |
| HasMember | Allowed | B | 273 | Improper Check for Dropped Privileges |
| HasMember | Allowed | B | 283 | Unverified Ownership |
| HasMember | Allowed | B | 290 | Authentication Bypass by Spoofing |
| HasMember | Allowed | B | 294 | Authentication Bypass by Capture-replay |
| HasMember | Allowed | B | 296 | Improper Following of a Certificate's Chain of Trust |
| HasMember | Allowed | B | 299 | Improper Check for Certificate Revocation |
| HasMember | Discouraged | C | 300 | Channel Accessible by Non-Endpoint |
| HasMember | Allowed | B | 301 | Reflection Attack in an Authentication Protocol |
| HasMember | Allowed | B | 304 | Missing Critical Step in Authentication |
| HasMember | Allowed | B | 306 | Missing Authentication for Critical Function |
| HasMember | Allowed | B | 307 | Improper Restriction of Excessive Authentication Attempts |
| HasMember | Allowed | B | 308 | Use of Single-factor Authentication |
| HasMember | Allowed | B | 312 | Cleartext Storage of Sensitive Information |
| HasMember | Allowed | B | 319 | Cleartext Transmission of Sensitive Information |
| HasMember | Allowed | B | 322 | Key Exchange without Entity Authentication |
| HasMember | Allowed | B | 323 | Reusing a Nonce, Key Pair in Encryption |
| HasMember | Allowed | B | 325 | Missing Cryptographic Step |
| HasMember | Allowed-with-Review | C | 327 | Use of a Broken or Risky Cryptographic Algorithm |
| HasMember | Allowed | B | 331 | Insufficient Entropy |
| HasMember | Allowed | B | 334 | Small Space of Random Values |
| HasMember | Allowed | B | 335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) |
| HasMember | Allowed | B | 338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
| HasMember | Allowed | B | 341 | Predictable from Observable State |
| HasMember | Allowed | B | 347 | Improper Verification of Cryptographic Signature |
| HasMember | Allowed | B | 348 | Use of Less Trusted Source |
| HasMember | Allowed | B | 349 | Acceptance of Extraneous Untrusted Data With Trusted Data |
| HasMember | Allowed | C | 352 | Cross-Site Request Forgery (CSRF) |
| HasMember | Allowed | B | 353 | Missing Support for Integrity Check |
| HasMember | Allowed | B | 354 | Improper Validation of Integrity Check Value |
| HasMember | Allowed | B | 364 | Signal Handler Race Condition |
| HasMember | Allowed | B | 367 | Time-of-check Time-of-use (TOCTOU) Race Condition |
| HasMember | Allowed | B | 369 | Divide By Zero |
| HasMember | Allowed | B | 390 | Detection of Error Condition Without Action |
| HasMember | Allowed | B | 392 | Missing Report of Error Condition |
| HasMember | Allowed | B | 393 | Return of Wrong Status Code |
| HasMember | Discouraged | C | 400 | Uncontrolled Resource Consumption |
| HasMember | Allowed-with-Review | C | 406 | Insufficient Control of Network Message Volume (Network Amplification) |
| HasMember | Allowed-with-Review | C | 407 | Inefficient Algorithmic Complexity |
| HasMember | Allowed | B | 408 | Incorrect Behavior Order: Early Amplification |
| HasMember | Allowed | B | 409 | Improper Handling of Highly Compressed Data (Data Amplification) |
| HasMember | Allowed | B | 434 | Unrestricted Upload of File with Dangerous Type |
| HasMember | Allowed | B | 444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| HasMember | Allowed-with-Review | C | 451 | User Interface (UI) Misrepresentation of Critical Information |
| HasMember | Allowed | V | 453 | Insecure Default Variable Initialization |
| HasMember | Allowed | B | 454 | External Initialization of Trusted Variables or Data Stores |
| HasMember | Allowed | B | 455 | Non-exit on Failed Initialization |
| HasMember | Allowed | V | 456 | Missing Initialization of a Variable |
| HasMember | Allowed | V | 467 | Use of sizeof() on a Pointer Type |
| HasMember | Allowed | B | 468 | Incorrect Pointer Scaling |
| HasMember | Allowed | B | 469 | Use of Pointer Subtraction to Determine Size |
| HasMember | Allowed | B | 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') |
| HasMember | Allowed | B | 476 | NULL Pointer Dereference |
| HasMember | Allowed | B | 478 | Missing Default Case in Multiple Condition Expression |
| HasMember | Allowed | B | 480 | Use of Incorrect Operator |
| HasMember | Allowed | B | 483 | Incorrect Block Delimitation |
| HasMember | Allowed | B | 484 | Omitted Break Statement in Switch |
| HasMember | Allowed | V | 486 | Comparison of Classes by Name |
| HasMember | Allowed | B | 494 | Download of Code Without Integrity Check |
| HasMember | Allowed | V | 495 | Private Data Structure Returned From A Public Method |
| HasMember | Allowed | V | 496 | Public Data Assigned to Private Array-Typed Field |
| HasMember | Allowed | V | 498 | Cloneable Class Containing Sensitive Information |
| HasMember | Allowed | V | 499 | Serializable Class Containing Sensitive Data |
| HasMember | Allowed | B | 502 | Deserialization of Untrusted Data |
| HasMember | Allowed | B | 521 | Weak Password Requirements |
| HasMember | Allowed-with-Review | C | 522 | Insufficiently Protected Credentials |
| HasMember | Allowed | V | 546 | Suspicious Comment |
| HasMember | Allowed | B | 547 | Use of Hard-coded, Security-relevant Constants |
| HasMember | Allowed | B | 561 | Dead Code |
| HasMember | Allowed | B | 563 | Assignment to Variable without Use |
| HasMember | Allowed | B | 567 | Unsynchronized Access to Shared Data in a Multithreaded Context |
| HasMember | Allowed | V | 587 | Assignment of a Fixed Address to a Pointer |
| HasMember | Allowed | V | 595 | Comparison of Object References Instead of Object Contents |
| HasMember | Allowed | B | 601 | URL Redirection to Untrusted Site ('Open Redirect') |
| HasMember | Allowed-with-Review | C | 602 | Client-Side Enforcement of Server-Side Security |
| HasMember | Allowed | V | 605 | Multiple Binds to the Same Port |
| HasMember | Allowed | B | 617 | Reachable Assertion |
| HasMember | Allowed | V | 621 | Variable Extraction Error |
| HasMember | Allowed | V | 627 | Dynamic Variable Evaluation |
| HasMember | Allowed | B | 628 | Function Call with Incorrectly Specified Arguments |
| HasMember | Allowed-with-Review | C | 642 | External Control of Critical State Data |
| HasMember | Allowed | B | 648 | Incorrect Use of Privileged APIs |
| HasMember | Allowed-with-Review | C | 667 | Improper Locking |
| HasMember | Allowed-with-Review | C | 672 | Operation on a Resource after Expiration or Release |
| HasMember | Allowed-with-Review | C | 674 | Uncontrolled Recursion |
| HasMember | Allowed | B | 676 | Use of Potentially Dangerous Function |
| HasMember | Allowed | B | 681 | Incorrect Conversion between Numeric Types |
| HasMember | Allowed | B | 698 | Execution After Redirect (EAR) |
| HasMember | Allowed | B | 708 | Incorrect Ownership Assignment |
| HasMember | Allowed-with-Review | C | 732 | Incorrect Permission Assignment for Critical Resource |
| HasMember | Allowed | B | 756 | Missing Custom Error Page |
| HasMember | Allowed | B | 763 | Release of Invalid Pointer or Reference |
| HasMember | Allowed | B | 770 | Allocation of Resources Without Limits or Throttling |
| HasMember | Allowed | B | 772 | Missing Release of Resource after Effective Lifetime |
| HasMember | Allowed | B | 783 | Operator Precedence Logic Error |
| HasMember | Discouraged | B | 786 | Access of Memory Location Before Start of Buffer |
| HasMember | Discouraged | B | 788 | Access of Memory Location After End of Buffer |
| HasMember | Allowed | B | 798 | Use of Hard-coded Credentials |
| HasMember | Allowed | B | 805 | Buffer Access with Incorrect Length Value |
| HasMember | Allowed | B | 807 | Reliance on Untrusted Inputs in a Security Decision |
| HasMember | Allowed | B | 822 | Untrusted Pointer Dereference |
| HasMember | Allowed | B | 825 | Expired Pointer Dereference |
| HasMember | Allowed | B | 829 | Inclusion of Functionality from Untrusted Control Sphere |
| HasMember | Allowed | B | 835 | Loop with Unreachable Exit Condition ('Infinite Loop') |
| HasMember | Allowed | B | 838 | Inappropriate Encoding for Output Context |
| HasMember | Allowed | B | 839 | Numeric Range Comparison Without Minimum Check |
| HasMember | Allowed | B | 841 | Improper Enforcement of Behavioral Workflow |
| HasMember | Allowed-with-Review | C | 862 | Missing Authorization |
| HasMember | Allowed-with-Review | C | 863 | Incorrect Authorization |