| HasMember | Discouraged | C | 119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
| HasMember | Allowed-with-Review | B | 120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
| HasMember | Allowed | V | 121 | Stack-based Buffer Overflow |
| HasMember | Allowed | V | 122 | Heap-based Buffer Overflow |
| HasMember | Allowed | B | 123 | Write-what-where Condition |
| HasMember | Allowed | B | 124 | Buffer Underwrite ('Buffer Underflow') |
| HasMember | Allowed | B | 1245 | Improper Finite State Machines (FSMs) in Hardware Logic |
| HasMember | Allowed | B | 125 | Out-of-bounds Read |
| HasMember | Allowed | B | 1253 | Incorrect Selection of Fuse Values |
| HasMember | Allowed | B | 1259 | Improper Restriction of Security Token Assignment |
| HasMember | Allowed | V | 126 | Buffer Over-read |
| HasMember | Allowed | B | 1261 | Improper Handling of Single Event Upsets |
| HasMember | Allowed | B | 1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents |
| HasMember | Allowed | B | 1270 | Generation of Incorrect Security Tokens |
| HasMember | Allowed | B | 1277 | Firmware Not Updateable |
| HasMember | Allowed | B | 128 | Wrap-around Error |
| HasMember | Allowed | V | 129 | Improper Validation of Array Index |
| HasMember | Allowed | B | 1302 | Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) |
| HasMember | Allowed | B | 1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation |
| HasMember | Allowed | B | 131 | Incorrect Calculation of Buffer Size |
| HasMember | Allowed | B | 1313 | Hardware Allows Activation of Test or Debug Logic at Runtime |
| HasMember | Allowed | B | 1317 | Improper Access Control in Fabric Bridge |
| HasMember | Allowed | B | 1318 | Missing Support for Security Features in On-chip Fabrics or Buses |
| HasMember | Allowed | B | 1320 | Improper Protection for Outbound Error Messages and Alert Signals |
| HasMember | Allowed | V | 1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
| HasMember | Allowed | B | 1329 | Reliance on Component That is Not Updateable |
| HasMember | Allowed | B | 1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy |
| HasMember | Allowed | B | 1335 | Incorrect Bitwise Shift of Integer |
| HasMember | Allowed | B | 1339 | Insufficient Precision or Accuracy of a Real Number |
| HasMember | Allowed | B | 1341 | Multiple Releases of Same Resource or Handle |
| HasMember | Allowed | B | 135 | Incorrect Calculation of Multi-Byte String Length |
| HasMember | Discouraged | C | 138 | Improper Neutralization of Special Elements |
| HasMember | Allowed | V | 1385 | Missing Origin Validation in WebSockets |
| HasMember | Allowed | B | 1429 | Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface |
| HasMember | Allowed | B | 166 | Improper Handling of Missing Special Element |
| HasMember | Allowed | B | 168 | Improper Handling of Inconsistent Special Elements |
| HasMember | Allowed | B | 170 | Improper Null Termination |
| HasMember | Allowed | B | 190 | Integer Overflow or Wraparound |
| HasMember | Allowed | B | 191 | Integer Underflow (Wrap or Wraparound) |
| HasMember | Allowed | V | 192 | Integer Coercion Error |
| HasMember | Allowed | B | 193 | Off-by-one Error |
| HasMember | Allowed | V | 196 | Unsigned to Signed Conversion Error |
| HasMember | Discouraged | C | 20 | Improper Input Validation |
| HasMember | Allowed | B | 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| HasMember | Allowed-with-Review | C | 228 | Improper Handling of Syntactically Invalid Structure |
| HasMember | Allowed | B | 23 | Relative Path Traversal |
| HasMember | Discouraged | V | 234 | Failure to Handle Missing Parameter |
| HasMember | Allowed | B | 248 | Uncaught Exception |
| HasMember | Allowed | B | 250 | Execution with Unnecessary Privileges |
| HasMember | Allowed | B | 252 | Unchecked Return Value |
| HasMember | Allowed | B | 253 | Incorrect Check of Function Return Value |
| HasMember | Allowed | V | 332 | Insufficient Entropy in PRNG |
| HasMember | Allowed | V | 333 | Improper Handling of Insufficient Entropy in TRNG |
| HasMember | Allowed | C | 352 | Cross-Site Request Forgery (CSRF) |
| HasMember | Allowed | B | 36 | Absolute Path Traversal |
| HasMember | Allowed-with-Review | C | 362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| HasMember | Allowed | B | 364 | Signal Handler Race Condition |
| HasMember | Allowed | B | 369 | Divide By Zero |
| HasMember | Allowed | V | 382 | J2EE Bad Practices: Use of System.exit() |
| HasMember | Allowed | V | 39 | Path Traversal: 'C:dirname' |
| HasMember | Discouraged | C | 400 | Uncontrolled Resource Consumption |
| HasMember | Allowed | V | 401 | Missing Release of Memory after Effective Lifetime |
| HasMember | Allowed-with-Review | C | 406 | Insufficient Control of Network Message Volume (Network Amplification) |
| HasMember | Allowed | B | 408 | Incorrect Behavior Order: Early Amplification |
| HasMember | Allowed | B | 409 | Improper Handling of Highly Compressed Data (Data Amplification) |
| HasMember | Allowed | C | 410 | Insufficient Resource Pool |
| HasMember | Allowed | B | 413 | Improper Resource Locking |
| HasMember | Allowed | B | 414 | Missing Lock Check |
| HasMember | Allowed | V | 416 | Use After Free |
| HasMember | Allowed-with-Review | B | 426 | Untrusted Search Path |
| HasMember | Allowed | B | 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') |
| HasMember | Allowed | B | 476 | NULL Pointer Dereference |
| HasMember | Allowed | B | 562 | Return of Stack Variable Address |
| HasMember | Allowed | B | 567 | Unsynchronized Access to Shared Data in a Multithreaded Context |
| HasMember | Allowed | V | 587 | Assignment of a Fixed Address to a Pointer |
| HasMember | Allowed | V | 588 | Attempt to Access Child of a Non-structure Pointer |
| HasMember | Allowed | V | 594 | J2EE Framework: Saving Unserializable Objects to Disk |
| HasMember | Allowed | V | 600 | Uncaught Exception in Servlet |
| HasMember | Allowed-with-Review | C | 602 | Client-Side Enforcement of Server-Side Security |
| HasMember | Allowed | B | 617 | Reachable Assertion |
| HasMember | Allowed | B | 641 | Improper Restriction of Names for Files and Other Resources |
| HasMember | Allowed-with-Review | C | 642 | External Control of Critical State Data |
| HasMember | Allowed | V | 646 | Reliance on File Name or Extension of Externally-Supplied File |
| HasMember | Discouraged | C | 665 | Improper Initialization |
| HasMember | Allowed | V | 67 | Improper Handling of Windows Device Names |
| HasMember | Allowed-with-Review | C | 672 | Operation on a Resource after Expiration or Release |
| HasMember | Discouraged | C | 680 | Integer Overflow to Buffer Overflow |
| HasMember | Discouraged | P | 682 | Incorrect Calculation |
| HasMember | Discouraged | C | 690 | Unchecked Return Value to NULL Pointer Dereference |
| HasMember | Discouraged | P | 703 | Improper Check or Handling of Exceptional Conditions |
| HasMember | Allowed | B | 73 | External Control of File Name or Path |
| HasMember | Allowed-with-Review | C | 754 | Improper Check for Unusual or Exceptional Conditions |
| HasMember | Allowed | V | 761 | Free of Pointer not at Start of Buffer |
| HasMember | Allowed | V | 762 | Mismatched Memory Management Routines |
| HasMember | Allowed | B | 763 | Release of Invalid Pointer or Reference |
| HasMember | Allowed | B | 764 | Multiple Locks of a Critical Resource |
| HasMember | Allowed | B | 765 | Multiple Unlocks of a Critical Resource |
| HasMember | Allowed | B | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HasMember | Allowed | V | 781 | Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code |
| HasMember | Allowed | V | 785 | Use of Path Manipulation Function without Maximum-sized Buffer |
| HasMember | Discouraged | B | 786 | Access of Memory Location Before Start of Buffer |
| HasMember | Allowed | B | 787 | Out-of-bounds Write |
| HasMember | Discouraged | B | 788 | Access of Memory Location After End of Buffer |
| HasMember | Allowed | B | 805 | Buffer Access with Incorrect Length Value |
| HasMember | Allowed | V | 806 | Buffer Access Using Size of Source Buffer |
| HasMember | Allowed | B | 822 | Untrusted Pointer Dereference |
| HasMember | Allowed | B | 823 | Use of Out-of-range Pointer Offset |
| HasMember | Allowed | B | 824 | Access of Uninitialized Pointer |
| HasMember | Allowed | B | 825 | Expired Pointer Dereference |
| HasMember | Allowed | B | 826 | Premature Release of Resource During Expected Lifetime |
| HasMember | Allowed | V | 828 | Signal Handler with Functionality that is not Asynchronous-Safe |
| HasMember | Allowed | V | 831 | Signal Handler Function Associated with Multiple Signals |
| HasMember | Allowed | B | 832 | Unlock of a Resource that is not Locked |
| HasMember | Allowed | B | 833 | Deadlock |
| HasMember | Discouraged | C | 834 | Excessive Iteration |
| HasMember | Allowed | B | 843 | Access of Resource Using Incompatible Type ('Type Confusion') |
| HasMember | Allowed-with-Review | C | 862 | Missing Authorization |
| HasMember | Allowed-with-Review | C | 863 | Incorrect Authorization |
| HasMember | Allowed | B | 908 | Use of Uninitialized Resource |
| HasMember | Allowed-with-Review | C | 909 | Missing Initialization of Resource |
| HasMember | Allowed | B | 910 | Use of Expired File Descriptor |
| HasMember | Allowed | B | 911 | Improper Update of Reference Count |
| HasMember | Allowed | B | 920 | Improper Restriction of Power Consumption |
| HasMember | Allowed | V | 926 | Improper Export of Android Application Components |