API Reference

List Top CWEs

Return the most-referenced CWEs across all scored CVEs, ranked by how often each weakness appears across the CVE dataset. Useful for identifying systemic vulnerability patterns in a portfolio.

GET

/v1/cwe/top

Cost: 1 credit per successful call

Query parameters

limitintegeroptionaldefault: 25

Maximum number of CWEs to return. Accepted range: 1–50.

Request

curl "https://api.precursorintelligence.com/functions/v1/cwe/top?limit=10" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 10,
    "limit": 10,
    "items": [
      {
        "cwe_text": "CWE-79",
        "cwe_id": 79,
        "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
        "cve_count": 4521,
        "likelihood_of_exploit": "High"
      },
      {
        "cwe_text": "CWE-89",
        "cwe_id": 89,
        "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
        "cve_count": 1843,
        "likelihood_of_exploit": "High"
      },
      {
        "cwe_text": "CWE-125",
        "cwe_id": 125,
        "name": "Out-of-bounds Read",
        "cve_count": 1710,
        "likelihood_of_exploit": "Medium"
      }
    ],
    "generated_at": "2026-05-29T10:15:00.000Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of entries returned (equals items.length).

data.limitintegeroptional

The maximum number of CWEs requested.

data.itemsarrayoptional

Top CWE entries ranked by cve_count descending. Each object contains the fields below.

data.items[].cwe_textstringoptional

Prefixed CWE identifier (e.g. CWE-79).

data.items[].cwe_idintegeroptional

CWE numeric identifier.

data.items[].namestringoptional

Official CWE weakness name.

data.items[].cve_countintegeroptional

Number of scored CVEs mapped to this CWE.

data.items[].likelihood_of_exploitstring | nulloptional

CWE-assigned likelihood of exploit (High, Medium, Low). null when not assigned.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_limit`	A parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.