What CVEs are caused by CWE-254?

379 recorded CVEs are attributed to CWE-254, including CVE-2016-5788, CVE-2015-3972 and CVE-2015-1158.

Is CWE-254 actively exploited?

379 recorded CVEs are caused by CWE-254; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-254: 7PK - Security Features

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Last updated May 1, 2026

379

Recorded CVEs

With this primary CWE

0

KEVs

In the CISA KEV catalog

11

Weaknesses

In this category

Incomplete

Status

Per MITRE

Weaknesses in this category

Real-world CVEs

379 recorded CVEs are caused by CWE-254 (7PK - Security Features). The highest-severity and most recent are shown first.

Showing 12 of 379 recorded CWE-254 CVEs. Get an alert for each new one, with AI-written analysis and fixes.

Monitor these CVEs

Frequently asked questions

Common questions about CWE-254.

What is CWE-254?: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
What CVEs are caused by CWE-254?: 379 recorded CVEs are attributed to CWE-254, including CVE-2016-5788, CVE-2015-3972 and CVE-2015-1158.
Is CWE-254 actively exploited?: 379 recorded CVEs are caused by CWE-254; none are currently in CISA's KEV catalog of actively exploited flaws.

Sources

[1]Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors (2005)

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.