MITRE · CWE List
MITRE Common Weakness Enumeration: real-world incidents for each item
CWE names the weakness; CollectSEA shows the incidents where that weakness caused real damage and the design safeguards that prevent it.
Official CWE- CWE-837
Improper Enforcement of a Single, Unique Action
The product does not ensure that an action meant to happen once can only happen once.
- CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts an action.
- GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)2025
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Stolen OAuth tokens from the Salesloft Drift integration are used to export data from customers' Salesforce instances (2025)2025
- AI coding agent deletes a live production database during a code freeze (Replit, 2025)2025
- Malicious code committed to the Amazon Q Developer VS Code extension via a compromised token (AWS, 2025)2025
- Hidden instructions in a support ticket make an MCP-connected assistant expose private SQL tables (Supabase MCP, 2025)2025
and 2 more in the linked patterns.
- CWE-639
Authorization Bypass Through User-Controlled Key
A user can access another user's data by modifying the key that identifies it.
- Non-secret app ID lets anyone register for private apps built on the Base44 AI app builder (2025)2025
- Default password and an IDOR in McDonald's AI hiring chatbot platform expose data on 64 million applicants (2025)2025
- Privilege escalation and a certificate-validation flaw allow cross-account database access (Azure PostgreSQL "ExtraReplica", 2022)2022
- Missing access checks in a document portal expose over 800 million First American images (2019)2019
- CWE-1427
Improper Neutralization of Input Used for LLM Prompting
Externally influenced input is used in a prompt without neutralizing instructions it may contain.
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)2025
- Hidden instructions in a support ticket make an MCP-connected assistant expose private SQL tables (Supabase MCP, 2025)2025
- EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)2025
- Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)2025
- CWE-770
Allocation of Resources Without Limits or Throttling
Resources are allocated without limits on how many can be requested.
- Latent race condition in DNS automation leaves DynamoDB's regional endpoint with an empty record (AWS, 2025)2025
- Third-party storage outage behind Workers KV takes down many Cloudflare services (2025)2025
- New Consul streaming feature under heavy load and a BoltDB issue cause a 73-hour outage (Roblox, 2021)2021
- Valid customer configuration change triggers a latent software bug across a CDN (Fastly, 2021)2021
- Holiday traffic surge overloads a Transit Gateway and stalls autoscaling provisioning (Slack, 2021)2021
- Regular expression in a WAF rule exhausts CPU on every edge server (Cloudflare, 2019)2019
and 2 more in the linked patterns.
- CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
A resource's state is checked and then used after it may have changed.
- Database permissions change doubles a bot-management feature file and crashes edge proxies (Cloudflare, 2025)2025
- Latent race condition in DNS automation leaves DynamoDB's regional endpoint with an empty record (AWS, 2025)2025
- Dormant configuration error in legacy routing systems withdraws Cloudflare's 1.1.1.1 DNS resolver worldwide (2025)2025
- Unplanned automatic OS update cuts networking for Heroku apps and its own status tools (2025)2025
- Blank provisioning parameter leads to automatic deletion of a customer's private cloud (UniSuper / Google Cloud, 2024)2024
- Deletion script given site IDs instead of app IDs removes 775 customers' sites (Atlassian, 2022)2022
and 1 more in the linked patterns.
- CWE-778
Insufficient Logging
Security-critical events are not recorded, or recorded without enough detail.
- Call and text records of nearly all AT&T wireless customers taken from a third-party cloud workspace (2024)2024
- Stolen credential opens Okta's support system, where uploaded HAR files held customer session tokens (2023)2023
- GitHub's RSA SSH host private key briefly exposed in a public repository (2023)2023
- Malware steals an engineer's SSO session and exposes CircleCI customer secrets (2023)2023
- Phishing impersonating a CI vendor yields GitHub credentials and 130 source-code repositories (Dropbox, 2022)2022
- SMS phishing of employees leads to compromise of Twilio customer accounts (2022)2022
and 2 more in the linked patterns.
- CWE-250
Execution with Unnecessary Privileges
Operations run with more privileges than they need.
- GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)2025
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)2025
- AI coding agent deletes a live production database during a code freeze (Replit, 2025)2025
- EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)2025
- Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)2025
and 2 more in the linked patterns.
- CWE-308
Use of Single-factor Authentication
Authentication relies on a single factor where stronger authentication is warranted.
- Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)2025
- GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)2025
- Stolen OAuth tokens from the Salesloft Drift integration are used to export data from customers' Salesforce instances (2025)2025
- Malicious code committed to the Amazon Q Developer VS Code extension via a compromised token (AWS, 2025)2025
- "ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)2025
- Default password and an IDOR in McDonald's AI hiring chatbot platform expose data on 64 million applicants (2025)2025
and 2 more in the linked patterns.
- CWE-1395
Dependency on Vulnerable Third-Party Component
The product depends on a third-party component that contains a known vulnerability.
- "ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)2025
- SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)2023
- Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)2021
- Capital One cloud breach and an $80 million OCC penalty for weak cloud-migration risk assessment (2019)2019
- Missing access checks in a document portal expose over 800 million First American images (2019)2019
- Access to the Starwood reservation network since 2014 exposes Marriott guest records (2018)2018
and 2 more in the linked patterns.
- CWE-653
Improper Isolation or Compartmentalization
Components with different privilege levels are not properly separated.
- Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)2025
- Ransomware shuts down CDK Global's dealer-management platform for about 15,000 dealerships (2024)2024
- Cyberattack disrupts Johnson Controls' internal IT infrastructure (2023)2023
- Help-desk social engineering leads to ransomware and a systems shutdown at MGM Resorts (2023)2023
- Cyberattack takes Clorox IT systems offline and forces manual order processing (2023)2023
- Attack on a senior DevOps engineer's computer leads to theft of cloud backups (LastPass, 2022-2023)2023
and 2 more in the linked patterns.
Mappings are CollectSEA's own analysis and are not produced or endorsed by MITRE. Item names and summaries paraphrase the official text; consult the source for the authoritative wording.