CWE Coverage Map

Reverse lookup: find which CME controls mitigate a given CWE weakness class. 129 distinct CWEs covered across 123 CME entries.

CWE-16 View on MITRE →

CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect

CWE-20 View on MITRE →

CWE-22 View on MITRE →

CME-904 WAF (Web Application Firewall) Harden
CME-1301 Path Traversal Prevention (Canonicalization) Harden
CME-1303 Application-Level Filesystem Access Confinement Isolate

CWE-23 View on MITRE →

CME-1301 Path Traversal Prevention (Canonicalization) Harden

CWE-36 View on MITRE →

CME-1301 Path Traversal Prevention (Canonicalization) Harden

CWE-59 View on MITRE →

CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) Harden

CWE-61 View on MITRE →

CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) Harden

CWE-73 View on MITRE →

CME-1301 Path Traversal Prevention (Canonicalization) Harden
CME-1303 Application-Level Filesystem Access Confinement Isolate

CWE-74 View on MITRE →

CME-1312 Argument Injection Prevention (Downstream Input Delimiter Sanitization) Harden

CWE-77 View on MITRE →

CME-1307 Command Injection Prevention (No Shell Invocation) Harden

CWE-78 View on MITRE →

CME-601 Kernel-Level Syscall Filtering (seccomp) Harden
CME-602 seccomp-bpf Profile (Container Default) Harden
CME-1307 Command Injection Prevention (No Shell Invocation) Harden

CWE-79 View on MITRE →

CME-904 WAF (Web Application Firewall) Harden
CME-905 Content Security Policy (CSP) Headers Harden
CME-1306 XSS Prevention (Context-Aware Output Encoding) Harden

CWE-88 View on MITRE →

CME-1312 Argument Injection Prevention (Downstream Input Delimiter Sanitization) Harden

CWE-89 View on MITRE →

CME-904 WAF (Web Application Firewall) Harden
CME-1305 SQL Injection Prevention (Parameterized Queries) Harden

CWE-93 View on MITRE →

CME-1313 CRLF / Line Injection Prevention (Newline Sanitization for Structured Formats) Harden

CWE-94 View on MITRE →

CME-102 NX/XD Bit (Non-Executable Memory) Harden
CME-107 Kernel Module Loading Restriction Harden
CME-502 noexec on /tmp and /dev/shm Harden
CME-713 Read-Only Root Filesystem Enforcement Harden
CME-904 WAF (Web Application Firewall) Harden
CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-95 View on MITRE →

CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-96 View on MITRE →

CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-113 View on MITRE →

CWE-119 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-102 NX/XD Bit (Non-Executable Memory) Harden
CME-104 KASLR (Kernel Address Space Layout Randomization) Harden
CME-105 SMEP (Supervisor Mode Execution Prevention) Harden
CME-106 SMAP (Supervisor Mode Access Prevention) Harden
CME-108 kptr_restrict (Kernel Pointer Restriction) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-601 Kernel-Level Syscall Filtering (seccomp) Harden
CME-602 seccomp-bpf Profile (Container Default) Harden
CME-603 Unprivileged BPF Disabled Harden
CME-604 Unprivileged User Namespaces Disabled Harden
CME-701 Sandboxing / gVisor Runtime Isolate
CME-919 JIT Compiler Hardening (JIT Restriction / V8 Sandbox) Harden
CME-1102 Live Kernel Patching (kpatch/livepatch) Evict

CWE-120 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-103 Stack Canaries (Stack Protector) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-121 View on MITRE →

CME-103 Stack Canaries (Stack Protector) Harden

CWE-122 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-103 Stack Canaries (Stack Protector) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) Harden

CWE-125 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-130 View on MITRE →

CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-1311 Input Size and Quantity Bounds Enforcement Harden

CWE-131 View on MITRE →

CWE-180 View on MITRE →

CME-1314 Input Canonicalization Before Security Decision Harden

CWE-183 View on MITRE →

CWE-184 View on MITRE →

CWE-190 View on MITRE →

CWE-191 View on MITRE →

CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) Harden

CWE-192 View on MITRE →

CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) Harden

CWE-193 View on MITRE →

CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-194 View on MITRE →

CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) Harden

CWE-195 View on MITRE →

CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) Harden

CWE-196 View on MITRE →

CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) Harden

CWE-197 View on MITRE →

CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) Harden

CWE-200 View on MITRE →

CME-106 SMAP (Supervisor Mode Access Prevention) Harden
CME-108 kptr_restrict (Kernel Pointer Restriction) Harden

CWE-223 View on MITRE →

CME-1006 Privilege Change Audit Logging Detect
CME-1011 Kubernetes API Server Audit Policy Detect

CWE-250 View on MITRE →

CME-703 Rootless Containers Isolate
CME-705 Dropped Linux Capabilities Isolate
CME-707 NoNewPrivileges Isolate
CME-708 Least Privilege sudo Configuration Isolate
CME-711 Admission Controller Policy Enforcement (OPA/Gatekeeper/Kyverno) Harden
CME-901 SSH Hardening (Comprehensive) Harden
CME-911 Fine-Grained Administrative Permission Scoping Isolate

CWE-266 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden
CME-910 Role Separation / Duty Segregation Isolate
CME-911 Fine-Grained Administrative Permission Scoping Isolate
CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Detect

CWE-268 View on MITRE →

CME-910 Role Separation / Duty Segregation Isolate

CWE-269 View on MITRE →

CME-104 KASLR (Kernel Address Space Layout Randomization) Harden
CME-105 SMEP (Supervisor Mode Execution Prevention) Harden
CME-106 SMAP (Supervisor Mode Access Prevention) Harden
CME-109 Kernel Lockdown Mode Harden
CME-110 KEXEC Restriction Harden
CME-111 Secure Boot (UEFI) Harden
CME-301 SELinux (Enforcing Mode) Harden
CME-302 SELinux Confined User Mapping Harden
CME-304 AppArmor (Enforcing Profile) Harden
CME-503 nosuid on Non-Root Partitions Harden
CME-506 Landlock LSM (Filesystem Sandboxing) Isolate
CME-602 seccomp-bpf Profile (Container Default) Harden
CME-603 Unprivileged BPF Disabled Harden
CME-604 Unprivileged User Namespaces Disabled Harden
CME-701 Sandboxing / gVisor Runtime Isolate
CME-702 Linux Namespaces (User, PID, Network, Mount) Isolate
CME-703 Rootless Containers Isolate
CME-705 Dropped Linux Capabilities Isolate
CME-706 Pod Security Standards (Restricted) Isolate
CME-707 NoNewPrivileges Isolate
CME-708 Least Privilege sudo Configuration Isolate
CME-709 systemd Service Sandboxing (PrivateDevices, PrivateTmp, ProtectSystem) Isolate
CME-710 DynamicUser (systemd) Isolate
CME-711 Admission Controller Policy Enforcement (OPA/Gatekeeper/Kyverno) Harden
CME-713 Read-Only Root Filesystem Enforcement Harden
CME-910 Role Separation / Duty Segregation Isolate
CME-911 Fine-Grained Administrative Permission Scoping Isolate
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Detect

CWE-284 View on MITRE →

CME-109 Kernel Lockdown Mode Harden
CME-201 Zero Trust Gateway / Identity-Aware Proxy Isolate
CME-202 Host-Based Firewall (firewalld/nftables) Isolate
CME-203 Network Segmentation (VLANs/Subnets) Isolate
CME-205 Service Binding to Localhost Isolate
CME-206 Network Policy (Kubernetes) Isolate
CME-301 SELinux (Enforcing Mode) Harden
CME-302 SELinux Confined User Mapping Harden
CME-303 SELinux Booleans (Restrictive) Harden
CME-304 AppArmor (Enforcing Profile) Harden
CME-501 Read-Only Root Filesystem Isolate
CME-506 Landlock LSM (Filesystem Sandboxing) Isolate
CME-706 Pod Security Standards (Restricted) Isolate
CME-709 systemd Service Sandboxing (PrivateDevices, PrivateTmp, ProtectSystem) Isolate
CME-711 Admission Controller Policy Enforcement (OPA/Gatekeeper/Kyverno) Harden
CME-902 Disable Unused Network Services Harden
CME-903 Kernel Network Hardening (sysctl) Harden
CME-908 Object-Level Authorization Checks (IDOR Prevention) Harden
CME-918 URL Path Authorization Enforcement (Forced Browsing Prevention) Harden
CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Detect
CME-1303 Application-Level Filesystem Access Confinement Isolate

CWE-285 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden

CWE-287 View on MITRE →

CME-201 Zero Trust Gateway / Identity-Aware Proxy Isolate
CME-801 Multi-Factor Authentication (MFA) Harden
CME-804 SSH Key-Only Authentication Harden
CME-806 Kerberos Authentication (GSSAPI) Harden
CME-901 SSH Hardening (Comprehensive) Harden

CWE-295 View on MITRE →

CME-404 Certificate Pinning Harden

CWE-300 View on MITRE →

CME-204 IPsec / WireGuard (Encrypted Transport) Isolate

CWE-303 View on MITRE →

CME-801 Multi-Factor Authentication (MFA) Harden
CME-806 Kerberos Authentication (GSSAPI) Harden

CWE-305 View on MITRE →

CME-801 Multi-Factor Authentication (MFA) Harden

CWE-306 View on MITRE →

CME-201 Zero Trust Gateway / Identity-Aware Proxy Isolate
CME-801 Multi-Factor Authentication (MFA) Harden
CME-909 Default-Deny API Authorization Policy Harden
CME-918 URL Path Authorization Enforcement (Forced Browsing Prevention) Harden

CWE-307 View on MITRE →

CME-803 Account Lockout Policy (pam_faillock) Harden
CME-906 Rate Limiting / Connection Throttling Harden

CWE-311 View on MITRE →

CME-204 IPsec / WireGuard (Encrypted Transport) Isolate
CME-407 Data-at-Rest Encryption (LUKS/dm-crypt / BitLocker) Harden

CWE-312 View on MITRE →

CME-407 Data-at-Rest Encryption (LUKS/dm-crypt / BitLocker) Harden

CWE-316 View on MITRE →

CME-407 Data-at-Rest Encryption (LUKS/dm-crypt / BitLocker) Harden

CWE-319 View on MITRE →

CME-204 IPsec / WireGuard (Encrypted Transport) Isolate
CME-806 Kerberos Authentication (GSSAPI) Harden

CWE-326 View on MITRE →

CME-401 System-wide Crypto Policy (FUTURE) Harden
CME-402 FIPS 140-3 Mode Harden

CWE-327 View on MITRE →

CME-401 System-wide Crypto Policy (FUTURE) Harden
CME-402 FIPS 140-3 Mode Harden
CME-403 TLS 1.3 Enforcement Harden

CWE-328 View on MITRE →

CME-402 FIPS 140-3 Mode Harden

CWE-345 View on MITRE →

CME-111 Secure Boot (UEFI) Harden
CME-406 Signed Package Enforcement (GPG) Harden
CME-504 dm-verity (Verified Boot) Harden
CME-505 IMA/EVM (Integrity Measurement Architecture) Harden
CME-712 Container Image Signing and Provenance Verification (Cosign/Sigstore) Harden
CME-1004 AIDE / File Integrity Monitoring Detect
CME-1202 Automated Backup with Integrity Verification Restore

CWE-346 View on MITRE →

CME-207 DNS Rebinding Protection Harden
CME-914 Strict CORS Origin Allowlist Enforcement Harden
CME-915 Cross-Origin Request Restriction (Reverse Proxy Origin Enforcement) Harden
CME-916 SameSite Cookie Attribute Enforcement Harden
CME-1308 Origin and CORS Validation Enforcement Harden

CWE-347 View on MITRE →

CME-111 Secure Boot (UEFI) Harden
CME-406 Signed Package Enforcement (GPG) Harden
CME-504 dm-verity (Verified Boot) Harden
CME-505 IMA/EVM (Integrity Measurement Architecture) Harden

CWE-350 View on MITRE →

CME-207 DNS Rebinding Protection Harden
CME-405 DNSSEC Validation Harden
CME-903 Kernel Network Hardening (sysctl) Harden

CWE-352 View on MITRE →

CWE-362 View on MITRE →

CWE-367 View on MITRE →

CWE-384 View on MITRE →

CME-807 Session Lifetime and Idle Timeout Enforcement Harden

CWE-400 View on MITRE →

CME-114 Process Resource Limits (ulimit/prlimit) Harden
CME-704 cgroups v2 Resource Limits Isolate
CME-906 Rate Limiting / Connection Throttling Harden
CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) Detect
CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) Restore

CWE-401 View on MITRE →

CWE-405 View on MITRE →

CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) Harden

CWE-407 View on MITRE →

CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) Harden

CWE-415 View on MITRE →

CWE-416 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-102 NX/XD Bit (Non-Executable Memory) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-425 View on MITRE →

CME-918 URL Path Authorization Enforcement (Forced Browsing Prevention) Harden

CWE-426 View on MITRE →

CWE-427 View on MITRE →

CWE-428 View on MITRE →

CME-508 Quoted Service Path Enforcement (Windows) Harden

CWE-434 View on MITRE →

CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) Harden

CWE-436 View on MITRE →

CME-912 HTTP Header Normalization and Request Smuggling Prevention Harden

CWE-441 View on MITRE →

CME-208 Outbound Network Egress Restriction (SSRF Blast Radius Containment) Isolate

CWE-444 View on MITRE →

CME-912 HTTP Header Normalization and Request Smuggling Prevention Harden

CWE-476 View on MITRE →

CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-494 View on MITRE →

CME-111 Secure Boot (UEFI) Harden
CME-406 Signed Package Enforcement (GPG) Harden
CME-504 dm-verity (Verified Boot) Harden
CME-505 IMA/EVM (Integrity Measurement Architecture) Harden
CME-712 Container Image Signing and Provenance Verification (Cosign/Sigstore) Harden

CWE-502 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden

CWE-506 View on MITRE →

CME-713 Read-Only Root Filesystem Enforcement Harden

CWE-521 View on MITRE →

CME-801 Multi-Factor Authentication (MFA) Harden
CME-802 Password Quality Enforcement (pwquality) Harden
CME-804 SSH Key-Only Authentication Harden
CME-805 Credential Rotation Policy Harden

CWE-539 View on MITRE →

CME-807 Session Lifetime and Idle Timeout Enforcement Harden

CWE-551 View on MITRE →

CME-909 Default-Deny API Authorization Policy Harden

CWE-601 View on MITRE →

CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) Harden

CWE-611 View on MITRE →

CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) Harden

CWE-613 View on MITRE →

CME-807 Session Lifetime and Idle Timeout Enforcement Harden

CWE-639 View on MITRE →

CME-908 Object-Level Authorization Checks (IDOR Prevention) Harden

CWE-641 View on MITRE →

CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) Harden

CWE-646 View on MITRE →

CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) Harden

CWE-653 View on MITRE →

CME-301 SELinux (Enforcing Mode) Harden
CME-601 Kernel-Level Syscall Filtering (seccomp) Harden
CME-701 Sandboxing / gVisor Runtime Isolate

CWE-668 View on MITRE →

CME-203 Network Segmentation (VLANs/Subnets) Isolate
CME-205 Service Binding to Localhost Isolate
CME-206 Network Policy (Kubernetes) Isolate
CME-902 Disable Unused Network Services Harden

CWE-681 View on MITRE →

CWE-693 View on MITRE →

CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) Harden

CWE-730 View on MITRE →

CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) Harden

CWE-732 View on MITRE →

CME-301 SELinux (Enforcing Mode) Harden

CWE-757 View on MITRE →

CME-401 System-wide Crypto Policy (FUTURE) Harden
CME-403 TLS 1.3 Enforcement Harden

CWE-770 View on MITRE →

CME-114 Process Resource Limits (ulimit/prlimit) Harden
CME-704 cgroups v2 Resource Limits Isolate
CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) Detect
CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) Restore

CWE-772 View on MITRE →

CWE-776 View on MITRE →

CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) Harden

CWE-778 View on MITRE →

CME-1002 Audit Subsystem (auditd) Detect
CME-1006 Privilege Change Audit Logging Detect
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1011 Kubernetes API Server Audit Policy Detect

CWE-787 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-919 JIT Compiler Hardening (JIT Restriction / V8 Sandbox) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-798 View on MITRE →

CME-805 Credential Rotation Policy Harden

CWE-825 View on MITRE →

CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) Harden

CWE-827 View on MITRE →

CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) Harden

CWE-829 View on MITRE →

CWE-834 View on MITRE →

CWE-835 View on MITRE →

CWE-843 View on MITRE →

CWE-862 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden
CME-909 Default-Deny API Authorization Policy Harden
CME-918 URL Path Authorization Enforcement (Forced Browsing Prevention) Harden

CWE-863 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden

CWE-915 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden

CWE-917 View on MITRE →

CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-918 View on MITRE →

CWE-940 View on MITRE →

CWE-942 View on MITRE →

CME-915 Cross-Origin Request Restriction (Reverse Proxy Origin Enforcement) Harden

CWE-1188 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden

CWE-1220 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden
CME-909 Default-Deny API Authorization Policy Harden
CME-911 Fine-Grained Administrative Permission Scoping Isolate
CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect

CWE-1275 View on MITRE →

CME-916 SameSite Cookie Attribute Enforcement Harden

CWE-1284 View on MITRE →

CME-1311 Input Size and Quantity Bounds Enforcement Harden

CWE-1285 View on MITRE →

CME-1311 Input Size and Quantity Bounds Enforcement Harden

CWE-1286 View on MITRE →

CWE-1289 View on MITRE →

CME-1314 Input Canonicalization Before Security Decision Harden

CWE-1321 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden

CWE-1333 View on MITRE →

CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) Harden