| HasMember | Allowed | V | 1004 | Sensitive Cookie Without 'HttpOnly' Flag |
| HasMember | Allowed | B | 1021 | Improper Restriction of Rendered UI Layers or Frames |
| HasMember | Allowed-with-Review | C | 1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism |
| HasMember | Allowed | V | 11 | ASP.NET Misconfiguration: Creating Debug Binary |
| HasMember | Allowed | B | 1191 | On-Chip Debug and Test Interface With Improper Access Control |
| HasMember | Allowed | V | 12 | ASP.NET Misconfiguration: Missing Custom Error Page |
| HasMember | Allowed | B | 1204 | Generation of Weak Initialization Vector (IV) |
| HasMember | Allowed | B | 1236 | Improper Neutralization of Formula Elements in a CSV File |
| HasMember | Allowed | B | 1240 | Use of a Cryptographic Primitive with a Risky Implementation |
| HasMember | Allowed | B | 1241 | Use of Predictable Algorithm in Random Number Generator |
| HasMember | Allowed | V | 1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks |
| HasMember | Allowed | B | 1262 | Improper Access Control for Register Interface |
| HasMember | Allowed | B | 1264 | Hardware Logic with Insecure De-Synchronization between Control and Data Channels |
| HasMember | Allowed | B | 1272 | Sensitive Information Uncleared Before Debug/Power State Transition |
| HasMember | Allowed | B | 1280 | Access Control Check Implemented After Asset is Accessed |
| HasMember | Allowed | B | 1283 | Mutable Attestation or Measurement Reporting Data |
| HasMember | Allowed | B | 1293 | Missing Source Correlation of Multiple Independent Data |
| HasMember | Allowed | B | 1300 | Improper Protection of Physical Side Channels |
| HasMember | Allowed | B | 1301 | Insufficient or Incomplete Data Removal within Hardware Component |
| HasMember | Allowed | B | 1303 | Non-Transparent Sharing of Microarchitectural Resources |
| HasMember | Allowed | B | 1339 | Insufficient Precision or Accuracy of a Real Number |
| HasMember | Allowed | V | 1385 | Missing Origin Validation in WebSockets |
| HasMember | Allowed | B | 1389 | Incorrect Parsing of Numbers with Different Radices |
| HasMember | Allowed-with-Review | C | 1390 | Weak Authentication |
| HasMember | Allowed-with-Review | C | 1419 | Incorrect Initialization of Resource |
| HasMember | Allowed | B | 1427 | Improper Neutralization of Input Used for LLM Prompting |
| HasMember | Allowed | B | 1428 | Reliance on HTTP instead of HTTPS |
| HasMember | Allowed | B | 1431 | Driving Intermediate Cryptographic State/Results to Hardware Module Outputs |
| HasMember | Discouraged | C | 200 | Exposure of Sensitive Information to an Unauthorized Actor |
| HasMember | Allowed | B | 201 | Insertion of Sensitive Information Into Sent Data |
| HasMember | Allowed | B | 202 | Exposure of Sensitive Information Through Data Queries |
| HasMember | Allowed | B | 203 | Observable Discrepancy |
| HasMember | Allowed | B | 204 | Observable Response Discrepancy |
| HasMember | Allowed | B | 205 | Observable Behavioral Discrepancy |
| HasMember | Allowed | V | 206 | Observable Internal Behavioral Discrepancy |
| HasMember | Allowed | V | 207 | Observable Behavioral Discrepancy With Equivalent Products |
| HasMember | Allowed | B | 208 | Observable Timing Discrepancy |
| HasMember | Allowed | B | 209 | Generation of Error Message Containing Sensitive Information |
| HasMember | Allowed | B | 210 | Self-generated Error Message Containing Sensitive Information |
| HasMember | Allowed | B | 211 | Externally-Generated Error Message Containing Sensitive Information |
| HasMember | Allowed | B | 212 | Improper Removal of Sensitive Information Before Storage or Transfer |
| HasMember | Allowed | B | 213 | Exposure of Sensitive Information Due to Incompatible Policies |
| HasMember | Allowed | B | 214 | Invocation of Process Using Visible Sensitive Information |
| HasMember | Allowed | B | 215 | Insertion of Sensitive Information Into Debugging Code |
| HasMember | Allowed | V | 219 | Storage of File with Sensitive Data Under Web Root |
| HasMember | Allowed | V | 220 | Storage of File With Sensitive Data Under FTP Root |
| HasMember | Allowed | B | 226 | Sensitive Information in Resource Not Removed Before Reuse |
| HasMember | Allowed | B | 248 | Uncaught Exception |
| HasMember | Allowed | B | 250 | Execution with Unnecessary Privileges |
| HasMember | Allowed | B | 272 | Least Privilege Violation |
| HasMember | Allowed | B | 276 | Incorrect Default Permissions |
| HasMember | Allowed | V | 277 | Insecure Inherited Permissions |
| HasMember | Allowed | V | 278 | Insecure Preserved Inherited Permissions |
| HasMember | Allowed | V | 279 | Incorrect Execution-Assigned Permissions |
| HasMember | Allowed | B | 281 | Improper Preservation of Permissions |
| HasMember | Discouraged | C | 285 | Improper Authorization |
| HasMember | Discouraged | C | 287 | Improper Authentication |
| HasMember | Allowed | B | 299 | Improper Check for Certificate Revocation |
| HasMember | Discouraged | C | 300 | Channel Accessible by Non-Endpoint |
| HasMember | Allowed | B | 304 | Missing Critical Step in Authentication |
| HasMember | Discouraged | C | 311 | Missing Encryption of Sensitive Data |
| HasMember | Allowed | B | 312 | Cleartext Storage of Sensitive Information |
| HasMember | Allowed | V | 313 | Cleartext Storage in a File or on Disk |
| HasMember | Allowed | V | 314 | Cleartext Storage in the Registry |
| HasMember | Allowed | V | 315 | Cleartext Storage of Sensitive Information in a Cookie |
| HasMember | Allowed | V | 317 | Cleartext Storage of Sensitive Information in GUI |
| HasMember | Allowed | V | 318 | Cleartext Storage of Sensitive Information in Executable |
| HasMember | Allowed | B | 319 | Cleartext Transmission of Sensitive Information |
| HasMember | Allowed | V | 321 | Use of Hard-coded Cryptographic Key |
| HasMember | Allowed | B | 322 | Key Exchange without Entity Authentication |
| HasMember | Allowed | B | 325 | Missing Cryptographic Step |
| HasMember | Allowed-with-Review | C | 326 | Inadequate Encryption Strength |
| HasMember | Allowed-with-Review | C | 327 | Use of a Broken or Risky Cryptographic Algorithm |
| HasMember | Allowed | V | 329 | Generation of Predictable IV with CBC Mode |
| HasMember | Allowed | C | 352 | Cross-Site Request Forgery (CSRF) |
| HasMember | Allowed | B | 359 | Exposure of Private Personal Information to an Unauthorized Actor |
| HasMember | Allowed-with-Review | C | 362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| HasMember | Allowed | B | 368 | Context Switching Race Condition |
| HasMember | Allowed | V | 370 | Missing Check for Certificate Revocation after Initial Check |
| HasMember | Allowed | B | 378 | Creation of Temporary File With Insecure Permissions |
| HasMember | Allowed | B | 379 | Creation of Temporary File in Directory with Insecure Permissions |
| HasMember | Allowed | B | 385 | Covert Timing Channel |
| HasMember | Allowed | B | 386 | Symbolic Name not Mapping to Correct Object |
| HasMember | Allowed-with-Review | C | 402 | Transmission of Private Resources into a New Sphere ('Resource Leak') |
| HasMember | Allowed | B | 403 | Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') |
| HasMember | Allowed-with-Review | C | 404 | Improper Resource Shutdown or Release |
| HasMember | Allowed | B | 425 | Direct Request ('Forced Browsing') |
| HasMember | Allowed | V | 433 | Unparsed Raw Web Content Delivery |
| HasMember | Allowed | B | 459 | Incomplete Cleanup |
| HasMember | Allowed | B | 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') |
| HasMember | Allowed | B | 487 | Reliance on Package-level Scope |
| HasMember | Allowed | B | 488 | Exposure of Data Element to Wrong Session |
| HasMember | Allowed | B | 489 | Active Debug Code |
| HasMember | Allowed | V | 492 | Use of Inner Class Containing Sensitive Data |
| HasMember | Allowed | V | 493 | Critical Public Variable Without Final Modifier |
| HasMember | Allowed | B | 497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere |
| HasMember | Allowed | V | 499 | Serializable Class Containing Sensitive Data |
| HasMember | Allowed | V | 5 | J2EE Misconfiguration: Data Transmission Without Encryption |
| HasMember | Allowed | V | 500 | Public Static Field Not Marked Final |
| HasMember | Allowed | B | 512 | Spyware |
| HasMember | Allowed-with-Review | C | 514 | Covert Channel |
| HasMember | Allowed | B | 515 | Covert Storage Channel |
| HasMember | Allowed | B | 524 | Use of Cache Containing Sensitive Information |
| HasMember | Allowed | V | 525 | Use of Web Browser Cache Containing Sensitive Information |
| HasMember | Allowed | V | 526 | Cleartext Storage of Sensitive Information in an Environment Variable |
| HasMember | Allowed | V | 527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere |
| HasMember | Allowed | V | 528 | Exposure of Core Dump File to an Unauthorized Control Sphere |
| HasMember | Allowed | V | 529 | Exposure of Access Control List Files to an Unauthorized Control Sphere |
| HasMember | Allowed | V | 530 | Exposure of Backup File to an Unauthorized Control Sphere |
| HasMember | Allowed | V | 531 | Inclusion of Sensitive Information in Test Code |
| HasMember | Allowed | B | 532 | Insertion of Sensitive Information into Log File |
| HasMember | Allowed | V | 535 | Exposure of Information Through Shell Error Message |
| HasMember | Allowed | V | 536 | Servlet Runtime Error Message Containing Sensitive Information |
| HasMember | Allowed | V | 537 | Java Runtime Error Message Containing Sensitive Information |
| HasMember | Allowed | V | 539 | Use of Persistent Cookies Containing Sensitive Information |
| HasMember | Allowed | B | 540 | Inclusion of Sensitive Information in Source Code |
| HasMember | Allowed | V | 541 | Inclusion of Sensitive Information in an Include File |
| HasMember | Allowed | V | 550 | Server-generated Error Message Containing Sensitive Information |
| HasMember | Allowed | V | 564 | SQL Injection: Hibernate |
| HasMember | Allowed | V | 566 | Authorization Bypass Through User-Controlled SQL Primary Key |
| HasMember | Allowed | B | 567 | Unsynchronized Access to Shared Data in a Multithreaded Context |
| HasMember | Allowed | V | 591 | Sensitive Data Storage in Improperly Locked Memory |
| HasMember | Allowed | V | 593 | Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created |
| HasMember | Allowed | V | 598 | Use of GET Request Method With Sensitive Query Strings |
| HasMember | Allowed | V | 599 | Missing Validation of OpenSSL Certificate |
| HasMember | Allowed | V | 600 | Uncaught Exception in Servlet |
| HasMember | Allowed | V | 605 | Multiple Binds to the Same Port |
| HasMember | Allowed | V | 608 | Struts: Non-private Field in ActionForm Class |
| HasMember | Discouraged | C | 610 | Externally Controlled Reference to a Resource in Another Sphere |
| HasMember | Allowed | B | 611 | Improper Restriction of XML External Entity Reference |
| HasMember | Allowed | B | 612 | Improper Authorization of Index Containing Sensitive Information |
| HasMember | Allowed | V | 614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
| HasMember | Allowed | V | 615 | Inclusion of Sensitive Information in Source Code Comments |
| HasMember | Allowed | B | 619 | Dangling Database Cursor ('Cursor Injection') |
| HasMember | Allowed-with-Review | C | 638 | Not Using Complete Mediation |
| HasMember | Allowed | B | 641 | Improper Restriction of Names for Files and Other Resources |
| HasMember | Allowed-with-Review | C | 642 | External Control of Critical State Data |
| HasMember | Allowed | B | 643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') |
| HasMember | Allowed | V | 644 | Improper Neutralization of HTTP Headers for Scripting Syntax |
| HasMember | Allowed | V | 646 | Reliance on File Name or Extension of Externally-Supplied File |
| HasMember | Allowed | B | 648 | Incorrect Use of Privileged APIs |
| HasMember | Allowed | V | 650 | Trusting HTTP Permission Methods on the Server Side |
| HasMember | Allowed | V | 651 | Exposure of WSDL File Containing Sensitive Information |
| HasMember | Allowed | B | 652 | Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') |
| HasMember | Discouraged | C | 662 | Improper Synchronization |
| HasMember | Allowed | B | 663 | Use of a Non-reentrant Function in a Concurrent Context |
| HasMember | Discouraged | C | 665 | Improper Initialization |
| HasMember | Discouraged | C | 668 | Exposure of Resource to Wrong Sphere |
| HasMember | Allowed-with-Review | C | 669 | Incorrect Resource Transfer Between Spheres |
| HasMember | Allowed | V | 67 | Improper Handling of Windows Device Names |
| HasMember | Allowed-with-Review | C | 672 | Operation on a Resource after Expiration or Release |
| HasMember | Allowed-with-Review | C | 674 | Uncontrolled Recursion |
| HasMember | Allowed | C | 689 | Permission Race Condition During Resource Copy |
| HasMember | Allowed | V | 7 | J2EE Misconfiguration: Missing Custom Error Page |
| HasMember | Discouraged | P | 703 | Improper Check or Handling of Exceptional Conditions |
| HasMember | Allowed-with-Review | C | 706 | Use of Incorrectly-Resolved Name or Reference |
| HasMember | Allowed | B | 708 | Incorrect Ownership Assignment |
| HasMember | Allowed-with-Review | C | 732 | Incorrect Permission Assignment for Critical Resource |
| HasMember | Discouraged | C | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| HasMember | Allowed | B | 749 | Exposed Dangerous Method or Function |
| HasMember | Allowed | B | 756 | Missing Custom Error Page |
| HasMember | Allowed | B | 766 | Critical Data Element Declared Public |
| HasMember | Allowed | B | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HasMember | Allowed | B | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| HasMember | Allowed | B | 798 | Use of Hard-coded Credentials |
| HasMember | Allowed | V | 8 | J2EE Misconfiguration: Entity Bean Declared Remote |
| HasMember | Allowed | V | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
| HasMember | Allowed | V | 81 | Improper Neutralization of Script in an Error Message Web Page |
| HasMember | Allowed | V | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
| HasMember | Allowed | B | 820 | Missing Synchronization |
| HasMember | Allowed | B | 821 | Incorrect Synchronization |
| HasMember | Allowed | B | 826 | Premature Release of Resource During Expected Lifetime |
| HasMember | Allowed | V | 83 | Improper Neutralization of Script in Attributes in a Web Page |
| HasMember | Allowed | V | 831 | Signal Handler Function Associated with Multiple Signals |
| HasMember | Allowed | V | 85 | Doubled Character XSS Manipulations |
| HasMember | Allowed | V | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
| HasMember | Allowed-with-Review | C | 862 | Missing Authorization |
| HasMember | Allowed-with-Review | C | 863 | Incorrect Authorization |
| HasMember | Allowed | V | 87 | Improper Neutralization of Alternate XSS Syntax |
| HasMember | Allowed | B | 88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') |
| HasMember | Allowed | B | 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| HasMember | Allowed | B | 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') |
| HasMember | Allowed | B | 908 | Use of Uninitialized Resource |
| HasMember | Allowed-with-Review | C | 909 | Missing Initialization of Resource |
| HasMember | Allowed | B | 91 | XML Injection (aka Blind XPath Injection) |
| HasMember | Allowed | B | 917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') |
| HasMember | Allowed | B | 918 | Server-Side Request Forgery (SSRF) |
| HasMember | Allowed | B | 921 | Storage of Sensitive Data in a Mechanism without Access Control |
| HasMember | Allowed-with-Review | C | 922 | Insecure Storage of Sensitive Information |
| HasMember | Allowed | V | 926 | Improper Export of Android Application Components |
| HasMember | Allowed | V | 927 | Use of Implicit Intent for Sensitive Communication |
| HasMember | Allowed | V | 942 | Permissive Cross-domain Policy with Untrusted Domains |
| HasMember | Allowed-with-Review | C | 943 | Improper Neutralization of Special Elements in Data Query Logic |
| HasMember | Allowed | V | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') |
| HasMember | Allowed | B | 96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') |
| HasMember | Allowed-with-Review | C | 99 | Improper Control of Resource Identifiers ('Resource Injection') |