auren-research/cyber-sec huggingface dataset:
The product's code, documentation, or other artifacts do not
consistently use the same naming conventions for variables, callables, groups of
related callables, I/O capabilities, data types, file names, or similar types of
elements.

Indirect

Implementation

Documentation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product due to inconsistencies, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The product or code does not isolate system-dependent
functionality into separate standalone modules.

Indirect

Implementation

Porting

Other
Reduce Maintainability
This issue makes it more difficult to maintain and/or port the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product uses automatically-generated code that cannot be
executed without a specific runtime support component.

Indirect

Architecture and Design

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The code uses a data representation that relies on low-level
data representation or constructs that may vary across different processors,
physical machines, OSes, or other physical components.

Indirect

Implementation

Porting

Other
Reduce Maintainability
This issue makes it more difficult to maintain and/or port the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product relies on third-party components that do
not provide equivalent functionality across all desirable
platforms.

Indirect

Architecture and Design

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product relies on third-party components that are not
actively supported or maintained by the original developer or a trusted proxy
for the original developer.

Indirect

Architecture and Design

Other
Reduce Maintainability
Varies by Context
Relying on unmaintained components makes it difficult or impossible to fix significant bugs and vulnerabilities, can render code obsolete, and undermine security by complicating maintenance and increasing the risk of new vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated References, Relationships

CWE Content Team
MITRE
2022-10-13
updated References

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Description, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Diagram, Relationships, Time_of_Introduction
The product or code uses machine-dependent functionality, but
it does not sufficiently encapsulate or isolate this functionality from
the rest of the code.

Indirect

Implementation

Porting

Other
Reduce Maintainability
This issue makes it more difficult to port or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

In this example function, the memory address of variable b is derived by adding 1 to the address of variable a. This derived address is then used to assign the value 0 to b.

void example() {char a;char b;*(&a + 1) = 0;}

Here, b may not be one byte past a. It may be one byte in front of a. Or, they may have three bytes between them because they are aligned on 32-bit boundaries.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples, Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The source code uses literal constants that may need to change
or evolve over time, instead of using symbolic constants.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.

char buffer[1024];...fgets(buffer, 1024, stdin);

If the buffer value needs to be changed, then it has to be altered in more than one place. If the developer forgets or does not find all occurrences, in this example it could lead to a buffer overflow.

enum { MAX_BUFFER_SIZE = 1024 };...char buffer[MAX_BUFFER_SIZE];...fgets(buffer, MAX_BUFFER_SIZE, stdin);

In this example the developer will only need to change one value and all references to the buffer size are updated, as a symbolic name is used instead of a hard-coded constant.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Time_of_Introduction
The source code uses symbolic constants, but it does not
sufficiently place the definitions of these constants into a more centralized or
isolated location.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The code is structured in a way that relies too much on using
or setting global variables throughout various points in the code, instead of
preserving the associated information in a narrower, more local
context.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The code contains a callable, block, or other code element in
which the same variable is used to control more than one unique task or store
more than one instance of data.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Other
Increase Analytical Complexity
Use of the same variable for multiple purposes can make it more difficult for a person to read or understand the code, potentially hiding other quality issues.

CVE-2023-26463
Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)
https://www.cve.org/CVERecord?id=CVE-2023-26463

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Time_of_Introduction
The product's design documentation does not adequately describe
control flow, data flow, system initialization, relationships between tasks,
components, rationales, or other important aspects of the
design.

Indirect

Architecture and Design

Documentation

Other
Reduce Maintainability

Other
Increase Analytical Complexity

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Time_of_Introduction
The product's documentation does not adequately define inputs,
outputs, or system/software interfaces.

Indirect

Documentation

Other
Reduce Maintainability

Other
Increase Analytical Complexity

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Time_of_Introduction
The document does not fully define all mechanisms that are used
to control or influence how product-specific programs are
executed.
This includes environmental variables, configuration files, registry keys, command-line switches or options, or system settings.

Indirect

Documentation

Other
Reduce Maintainability

Other
Increase Analytical Complexity

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Time_of_Introduction
The source code uses comment styles or formats that are
inconsistent or do not follow expected standards for the
product.

Indirect

Implementation

Other
Reduce Maintainability

Other
Increase Analytical Complexity
This issue makes it more difficult to maintain the product due to insufficient legibility, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction