Framework overlap

Does OWASP Top 10:2025 cover CWE Top 25 Most Dangerous Software Weaknesses (2024)?

You hold OWASP Top 10:2025 and have been told to do CWE Top 25 Most Dangerous Software Weaknesses (2024). Here is how much overlaps, control by control.

72% of CWE Top 25 Most Dangerous Software Weaknesses (2024) you already have

OWASP Top 10:2025 already covers about 72% of CWE Top 25 Most Dangerous Software Weaknesses (2024), leaving 7 of 25 controls as genuinely new work.

Already covered 18 Likely covered 0 New work 7

What is genuinely new work

Nothing in OWASP Top 10:2025 reaches these. This is the list to scope.

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read
CWE-190
Integer Overflow or Wraparound
CWE-400
Uncontrolled Resource Consumption
CWE-416
Use After Free
CWE-476
NULL Pointer Dereference
CWE-787
Out-of-bounds Write
Show the 18 you already have
CWE-20
Improper Input Validation
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-22
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
CWE-269
Improper Privilege Management
CWE-287
Improper Authentication
CWE-306
Missing Authentication for Critical Function
CWE-352
Cross-Site Request Forgery (CSRF)
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-502
Deserialization of Untrusted Data
CWE-77
Improper Neutralization of Special Elements used in a Command (Command Injection)
CWE-78
Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CWE-79
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
CWE-798
Use of Hard-coded Credentials
CWE-862
Missing Authorization
CWE-863
Incorrect Authorization
CWE-89
Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CWE-918
Server-Side Request Forgery (SSRF)
CWE-94
Improper Control of Generation of Code (Code Injection)

How this is calculated

Already covered means a mapping runs from a control in OWASP Top 10:2025 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition