CWE Coverage Map

Reverse lookup: find which CME controls mitigate a given CWE weakness class. 87 distinct CWEs covered across 104 CME entries.

CWE-16 View on MITRE →

CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect

CWE-20 View on MITRE →

CWE-22 View on MITRE →

CME-904 WAF (Web Application Firewall) Harden
CME-1301 Path Traversal Prevention (Canonicalization) Harden
CME-1303 Application-Level Filesystem Access Confinement Isolate

CWE-23 View on MITRE →

CME-1301 Path Traversal Prevention (Canonicalization) Harden

CWE-36 View on MITRE →

CME-1301 Path Traversal Prevention (Canonicalization) Harden

CWE-59 View on MITRE →

CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) Harden

CWE-61 View on MITRE →

CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) Harden

CWE-73 View on MITRE →

CME-1301 Path Traversal Prevention (Canonicalization) Harden
CME-1303 Application-Level Filesystem Access Confinement Isolate

CWE-77 View on MITRE →

CME-1307 Command Injection Prevention (No Shell Invocation) Harden

CWE-78 View on MITRE →

CME-601 Kernel-Level Syscall Filtering (seccomp) Harden
CME-602 seccomp-bpf Profile (Container Default) Harden
CME-1307 Command Injection Prevention (No Shell Invocation) Harden

CWE-79 View on MITRE →

CME-904 WAF (Web Application Firewall) Harden
CME-905 Content Security Policy (CSP) Headers Harden
CME-1306 XSS Prevention (Context-Aware Output Encoding) Harden

CWE-89 View on MITRE →

CME-904 WAF (Web Application Firewall) Harden
CME-1305 SQL Injection Prevention (Parameterized Queries) Harden

CWE-94 View on MITRE →

CME-102 NX/XD Bit (Non-Executable Memory) Harden
CME-107 Kernel Module Loading Restriction Harden
CME-502 noexec on /tmp and /dev/shm Harden
CME-904 WAF (Web Application Firewall) Harden
CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-95 View on MITRE →

CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-96 View on MITRE →

CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-113 View on MITRE →

CME-912 HTTP Header Normalization and Request Smuggling Prevention Harden

CWE-119 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-102 NX/XD Bit (Non-Executable Memory) Harden
CME-104 KASLR (Kernel Address Space Layout Randomization) Harden
CME-105 SMEP (Supervisor Mode Execution Prevention) Harden
CME-106 SMAP (Supervisor Mode Access Prevention) Harden
CME-108 kptr_restrict (Kernel Pointer Restriction) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-601 Kernel-Level Syscall Filtering (seccomp) Harden
CME-602 seccomp-bpf Profile (Container Default) Harden
CME-603 Unprivileged BPF Disabled Harden
CME-604 Unprivileged User Namespaces Disabled Harden
CME-701 Sandboxing / gVisor Runtime Isolate
CME-1102 Live Kernel Patching (kpatch/livepatch) Evict

CWE-120 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-103 Stack Canaries (Stack Protector) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-121 View on MITRE →

CME-103 Stack Canaries (Stack Protector) Harden

CWE-122 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-103 Stack Canaries (Stack Protector) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) Harden

CWE-125 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-131 View on MITRE →

CWE-190 View on MITRE →

CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-1311 Input Size and Quantity Bounds Enforcement Harden

CWE-193 View on MITRE →

CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-200 View on MITRE →

CME-106 SMAP (Supervisor Mode Access Prevention) Harden
CME-108 kptr_restrict (Kernel Pointer Restriction) Harden

CWE-223 View on MITRE →

CME-1006 Privilege Change Audit Logging Detect

CWE-250 View on MITRE →

CME-703 Rootless Containers Isolate
CME-705 Dropped Linux Capabilities Isolate
CME-707 NoNewPrivileges Isolate
CME-708 Least Privilege sudo Configuration Isolate
CME-901 SSH Hardening (Comprehensive) Harden
CME-911 Fine-Grained Administrative Permission Scoping Isolate

CWE-266 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden
CME-910 Role Separation / Duty Segregation Isolate
CME-911 Fine-Grained Administrative Permission Scoping Isolate
CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Detect

CWE-268 View on MITRE →

CME-910 Role Separation / Duty Segregation Isolate

CWE-269 View on MITRE →

CME-104 KASLR (Kernel Address Space Layout Randomization) Harden
CME-105 SMEP (Supervisor Mode Execution Prevention) Harden
CME-106 SMAP (Supervisor Mode Access Prevention) Harden
CME-109 Kernel Lockdown Mode Harden
CME-110 KEXEC Restriction Harden
CME-111 Secure Boot (UEFI) Harden
CME-301 SELinux (Enforcing Mode) Harden
CME-302 SELinux Confined User Mapping Harden
CME-304 AppArmor (Enforcing Profile) Harden
CME-503 nosuid on Non-Root Partitions Harden
CME-506 Landlock LSM (Filesystem Sandboxing) Isolate
CME-602 seccomp-bpf Profile (Container Default) Harden
CME-603 Unprivileged BPF Disabled Harden
CME-604 Unprivileged User Namespaces Disabled Harden
CME-701 Sandboxing / gVisor Runtime Isolate
CME-702 Linux Namespaces (User, PID, Network, Mount) Isolate
CME-703 Rootless Containers Isolate
CME-705 Dropped Linux Capabilities Isolate
CME-706 Pod Security Standards (Restricted) Isolate
CME-707 NoNewPrivileges Isolate
CME-708 Least Privilege sudo Configuration Isolate
CME-709 systemd Service Sandboxing (PrivateDevices, PrivateTmp, ProtectSystem) Isolate
CME-710 DynamicUser (systemd) Isolate
CME-910 Role Separation / Duty Segregation Isolate
CME-911 Fine-Grained Administrative Permission Scoping Isolate
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Detect

CWE-284 View on MITRE →

CME-109 Kernel Lockdown Mode Harden
CME-201 Zero Trust Gateway / Identity-Aware Proxy Isolate
CME-202 Host-Based Firewall (firewalld/nftables) Isolate
CME-203 Network Segmentation (VLANs/Subnets) Isolate
CME-205 Service Binding to Localhost Isolate
CME-206 Network Policy (Kubernetes) Isolate
CME-301 SELinux (Enforcing Mode) Harden
CME-302 SELinux Confined User Mapping Harden
CME-303 SELinux Booleans (Restrictive) Harden
CME-304 AppArmor (Enforcing Profile) Harden
CME-501 Read-Only Root Filesystem Isolate
CME-506 Landlock LSM (Filesystem Sandboxing) Isolate
CME-706 Pod Security Standards (Restricted) Isolate
CME-709 systemd Service Sandboxing (PrivateDevices, PrivateTmp, ProtectSystem) Isolate
CME-902 Disable Unused Network Services Harden
CME-903 Kernel Network Hardening (sysctl) Harden
CME-908 Object-Level Authorization Checks (IDOR Prevention) Harden
CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect
CME-1008 Application Admin Event Logging (SIEM Integration) Detect
CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Detect
CME-1303 Application-Level Filesystem Access Confinement Isolate

CWE-285 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden

CWE-287 View on MITRE →

CME-201 Zero Trust Gateway / Identity-Aware Proxy Isolate
CME-801 Multi-Factor Authentication (MFA) Harden
CME-804 SSH Key-Only Authentication Harden
CME-806 Kerberos Authentication (GSSAPI) Harden
CME-901 SSH Hardening (Comprehensive) Harden

CWE-295 View on MITRE →

CME-404 Certificate Pinning Harden

CWE-300 View on MITRE →

CME-204 IPsec / WireGuard (Encrypted Transport) Isolate

CWE-306 View on MITRE →

CME-201 Zero Trust Gateway / Identity-Aware Proxy Isolate
CME-801 Multi-Factor Authentication (MFA) Harden
CME-909 Default-Deny API Authorization Policy Harden

CWE-307 View on MITRE →

CME-803 Account Lockout Policy (pam_faillock) Harden
CME-906 Rate Limiting / Connection Throttling Harden

CWE-311 View on MITRE →

CME-204 IPsec / WireGuard (Encrypted Transport) Isolate
CME-407 Data-at-Rest Encryption (LUKS/dm-crypt) Harden

CWE-312 View on MITRE →

CME-407 Data-at-Rest Encryption (LUKS/dm-crypt) Harden

CWE-316 View on MITRE →

CME-407 Data-at-Rest Encryption (LUKS/dm-crypt) Harden

CWE-319 View on MITRE →

CME-204 IPsec / WireGuard (Encrypted Transport) Isolate
CME-806 Kerberos Authentication (GSSAPI) Harden

CWE-326 View on MITRE →

CME-401 System-wide Crypto Policy (FUTURE) Harden
CME-402 FIPS 140-3 Mode Harden

CWE-327 View on MITRE →

CME-401 System-wide Crypto Policy (FUTURE) Harden
CME-402 FIPS 140-3 Mode Harden
CME-403 TLS 1.3 Enforcement Harden

CWE-328 View on MITRE →

CME-402 FIPS 140-3 Mode Harden

CWE-345 View on MITRE →

CME-111 Secure Boot (UEFI) Harden
CME-406 Signed Package Enforcement (GPG) Harden
CME-504 dm-verity (Verified Boot) Harden
CME-505 IMA/EVM (Integrity Measurement Architecture) Harden
CME-1004 AIDE / File Integrity Monitoring Detect
CME-1202 Automated Backup with Integrity Verification Restore

CWE-346 View on MITRE →

CME-207 DNS Rebinding Protection Harden
CME-914 Strict CORS Origin Allowlist Enforcement Harden
CME-915 Cross-Origin Request Restriction (Reverse Proxy Origin Enforcement) Harden
CME-916 SameSite Cookie Attribute Enforcement Harden
CME-1308 Origin and CORS Validation Enforcement Harden

CWE-350 View on MITRE →

CME-207 DNS Rebinding Protection Harden
CME-405 DNSSEC Validation Harden
CME-903 Kernel Network Hardening (sysctl) Harden

CWE-352 View on MITRE →

CWE-362 View on MITRE →

CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) Harden

CWE-367 View on MITRE →

CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) Harden

CWE-400 View on MITRE →

CME-114 Process Resource Limits (ulimit/prlimit) Harden
CME-704 cgroups v2 Resource Limits Isolate
CME-906 Rate Limiting / Connection Throttling Harden

CWE-415 View on MITRE →

CWE-416 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-102 NX/XD Bit (Non-Executable Memory) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-426 View on MITRE →

CME-507 Secure Dynamic Linker Configuration (LD_PRELOAD/PATH Hardening) Harden

CWE-427 View on MITRE →

CWE-434 View on MITRE →

CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) Harden

CWE-436 View on MITRE →

CME-912 HTTP Header Normalization and Request Smuggling Prevention Harden

CWE-444 View on MITRE →

CME-912 HTTP Header Normalization and Request Smuggling Prevention Harden

CWE-476 View on MITRE →

CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-494 View on MITRE →

CME-111 Secure Boot (UEFI) Harden
CME-406 Signed Package Enforcement (GPG) Harden
CME-504 dm-verity (Verified Boot) Harden
CME-505 IMA/EVM (Integrity Measurement Architecture) Harden

CWE-502 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden

CWE-521 View on MITRE →

CME-801 Multi-Factor Authentication (MFA) Harden
CME-802 Password Quality Enforcement (pwquality) Harden
CME-804 SSH Key-Only Authentication Harden
CME-805 Credential Rotation Policy Harden

CWE-639 View on MITRE →

CME-908 Object-Level Authorization Checks (IDOR Prevention) Harden

CWE-646 View on MITRE →

CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) Harden

CWE-668 View on MITRE →

CME-203 Network Segmentation (VLANs/Subnets) Isolate
CME-205 Service Binding to Localhost Isolate
CME-206 Network Policy (Kubernetes) Isolate
CME-902 Disable Unused Network Services Harden

CWE-732 View on MITRE →

CME-301 SELinux (Enforcing Mode) Harden

CWE-757 View on MITRE →

CME-401 System-wide Crypto Policy (FUTURE) Harden
CME-403 TLS 1.3 Enforcement Harden

CWE-770 View on MITRE →

CME-114 Process Resource Limits (ulimit/prlimit) Harden
CME-704 cgroups v2 Resource Limits Isolate

CWE-778 View on MITRE →

CME-1002 Audit Subsystem (auditd) Detect
CME-1006 Privilege Change Audit Logging Detect
CME-1008 Application Admin Event Logging (SIEM Integration) Detect

CWE-787 View on MITRE →

CME-101 ASLR (Address Space Layout Randomization) Harden
CME-112 RELRO and PIE (Full) Harden
CME-113 Control Flow Integrity (CFI / Shadow Call Stack) Harden
CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) Harden
CME-1005 Runtime Memory Error Detection (KASAN/HWASan) Detect

CWE-798 View on MITRE →

CME-805 Credential Rotation Policy Harden

CWE-825 View on MITRE →

CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) Harden

CWE-829 View on MITRE →

CME-107 Kernel Module Loading Restriction Harden

CWE-834 View on MITRE →

CME-114 Process Resource Limits (ulimit/prlimit) Harden

CWE-835 View on MITRE →

CME-114 Process Resource Limits (ulimit/prlimit) Harden

CWE-862 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden
CME-909 Default-Deny API Authorization Policy Harden

CWE-863 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden

CWE-915 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden

CWE-917 View on MITRE →

CME-1309 Script Engine Restriction (Sandbox / Disable) Harden

CWE-918 View on MITRE →

CME-1304 SSRF Prevention (Outbound Request Allowlist) Harden

CWE-940 View on MITRE →

CWE-942 View on MITRE →

CME-915 Cross-Origin Request Restriction (Reverse Proxy Origin Enforcement) Harden

CWE-1220 View on MITRE →

CME-907 Application-Layer RBAC Enforcement Harden
CME-909 Default-Deny API Authorization Policy Harden
CME-911 Fine-Grained Administrative Permission Scoping Isolate
CME-1007 Application Configuration Drift Detection (IaC Enforcement) Detect

CWE-1275 View on MITRE →

CME-916 SameSite Cookie Attribute Enforcement Harden

CWE-1284 View on MITRE →

CME-1311 Input Size and Quantity Bounds Enforcement Harden

CWE-1285 View on MITRE →

CME-1311 Input Size and Quantity Bounds Enforcement Harden

CWE-1321 View on MITRE →

CME-1302 Deserialization Allowlist (Safe Loading) Harden