The weaknesses behind the exploited vulnerabilities.
One note for each weakness CISA's list keeps naming: what MITRE says, how often CISA names it, how to look for it. Every figure and quotation is checked against its source.
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory
6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-22, against 3 of 69 in the 90 days before.
- CWE-77: Improper Neutralization of Special Elements used in a Command
4 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-77, against 1 of 69 in the 90 days before.
- CWE-78: Improper Neutralization of Special Elements used in an OS Command
6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-78, against 6 of 69 in the 90 days before.
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command
4 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-89, against 3 of 69 in the 90 days before.
- CWE-94: Improper Control of Generation of Code
6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-94, against 3 of 69 in the 90 days before.
- CWE-190: Integer Overflow or Wraparound
1 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-190, against 1 of 69 in the 90 days before.
- CWE-287: Improper Authentication
7 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-287, against 5 of 69 in the 90 days before.
- CWE-456: Missing Initialization of a Variable
1 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-456, against 0 of 69 in the 90 days before.
- CWE-690: Unchecked Return Value to NULL Pointer Dereference
1 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-690, against 0 of 69 in the 90 days before.
- CWE-778: Insufficient Logging
1 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-778, against 0 of 69 in the 90 days before.
- CWE-787: Out-of-bounds Write
6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-787, against 2 of 69 in the 90 days before.
- CWE-918: Server-Side Request Forgery
5 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-918, against 2 of 69 in the 90 days before.
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us