CWE Top 25 Vulnerabilities: Most Dangerous Software Weaknesses

Application breaches rarely begin with a completely new flaw. Familiar coding, design, and configuration mistakes left in production software remain common points of exploitation.

Injection, memory corruption, authorization gaps, unsafe file handling, authentication failures, and missing resource limits make up much of the CWE Top 25. Treating these categories as root causes rather than isolated CVEs gives development and security teams clearer priorities for secure design, code review, testing, and remediation. The ranking also shows which implementation mistakes keep appearing across unrelated products.

MITRE’s latest CWE Top 25 analysis reviewed 39,080 CVE records published between June 1, 2024, and June 1, 2025. The analysis shows which software error classes continue to appear in serious vulnerability records and why CWE mapping matters before repeat defects become exploitable breach paths.

Key Takeaways

CWE Top 25 vulnerabilities identify software error classes frequently found across serious CVE records.
XSS, SQL injection, OS command injection, and code injection remain high-risk because attacker-controlled content reaches browsers, databases, servers, or executable logic.
Memory bugs such as Out-of-Bounds Write, Use-After-Free, and Buffer Overflow produce crashes, data leakage, privilege abuse, or remote code execution.
Authorization and authentication failures expose privileged functions if role checks, session handling, or identity verification break.
Path traversal, unrestricted file upload, SSRF, unsafe deserialization, and missing throttling create breach paths across web apps, APIs, cloud services, and backend components.

What Is the CWE Top 25 Vulnerabilities List?

CWE Top 25 vulnerabilities are MITRE-ranked software error classes linked to severe CVE records and serious exploitation outcomes. The Common Weakness Enumeration groups comparable coding, design, and configuration mistakes under shared IDs, allowing the same underlying defect to be tracked across different products.

Major categories include poor data handling, memory corruption, broken authorization logic, weak identity checks, file-processing errors, and missing resource limits. Defects in these areas expose confidential information, crash services, bypass permissions, or let attacker-controlled code run across software, APIs, and infrastructure.

Shared CWE IDs give developers, researchers, vendors, scanners, and AppSec programs a consistent way to classify findings. Scanner results can be compared with advisories and engineering tickets without treating every vulnerability as an unrelated bug. That makes the same coding or design defects easier to trace and fix at their source.

How Are CWE Top 25 Rankings Determined?

MITRE builds the CWE Top 25 by analyzing CVE records mapped to known weakness categories during a defined review period. Placement depends on prevalence and severity. Flaws tied to data exposure, privilege abuse, service disruption, command execution, or remote compromise receive greater weight, while known exploitation raises remediation priority.

Positions are not permanent. Changes in vulnerability data, mapping quality, and attacker behavior can move a category higher or lower between ranking periods.

CWE Top 25 Vulnerabilities List

MITRE’s CWE Top 25 ranks software flaw classes by prevalence and severity across CVE data. The table below combines rank, CWE ID, category, score, KEV presence, movement, danger level, and likely impact.

Rank	CWE ID	Vulnerability Type	Category	Score	CVEs in KEV	Rank Change vs 2024	Why It’s Dangerous	Typical Impact
1	CWE-79	Cross-Site Scripting	Injection	60.38	7	0	Runs attacker-controlled scripts in victim browsers	Session hijacking, account takeover
2	CWE-89	SQL Injection	Injection	28.72	4	1	Alters database queries through user input	Data breach, authentication bypass
3	CWE-352	Cross-Site Request Forgery	Session Abuse	13.64	0	1	Forces actions through an authenticated session	Unauthorized changes, data modification
4	CWE-862	Missing Authorization	Permission Checks	13.28	0	5	Skips permission checks on protected functions	Sensitive data exposure, privilege abuse
5	CWE-787	Out-of-Bounds Write	Memory Safety	12.68	12	-3	Writes beyond assigned memory boundaries	Remote code execution, crashes
6	CWE-22	Path Traversal	File Handling	8.99	10	-1	Reads files outside approved directories	Sensitive file disclosure
7	CWE-416	Use-After-Free	Memory Safety	8.47	14	1	Reuses memory after release	Code execution, instability
8	CWE-125	Out-of-Bounds Read	Memory Safety	7.88	3	-2	Reads memory beyond assigned buffers	Secret leakage, exploit chaining
9	CWE-78	OS Command Injection	Injection	7.85	20	-2	Runs attacker-supplied operating system commands	Host compromise
10	CWE-94	Code Injection	Injection	7.57	7	1	Executes attacker-controlled code inside an application	Application takeover
11	CWE-120	Classic Buffer Overflow	Memory Safety	6.96	0	N/A	Overwrites adjacent memory buffers	Code execution, crashes
12	CWE-434	Unrestricted File Upload	File Handling	6.87	4	-2	Allows harmful files into application paths	Web shells, malware upload
13	CWE-476	NULL Pointer Dereference	Memory Safety	6.41	0	8	Triggers runtime failure through null references	Denial of service
14	CWE-121	Stack-Based Buffer Overflow	Memory Safety	5.75	4	N/A	Corrupts stack execution flow	Privilege escalation, RCE
15	CWE-502	Deserialization of Untrusted Data	Design Flaw	5.23	11	1	Processes attacker-controlled serialized objects	Remote code execution
16	CWE-122	Heap-Based Buffer Overflow	Memory Safety	5.21	6	N/A	Corrupts heap memory structures	Heap corruption, exploit chaining
17	CWE-863	Incorrect Authorization	Permission Checks	4.14	4	1	Applies authorization rules incorrectly	IDOR, privilege escalation
18	CWE-20	Improper Input Validation	Input Handling	4.09	2	-6	Accepts untrusted input without proper checks	Logic bypass, injection
19	CWE-284	Improper Permission Management	Permission Checks	4.07	1	N/A	Enforces resource restrictions poorly	Unauthorized actions
20	CWE-200	Information Exposure	Data Disclosure	4.01	1	-3	Reveals sensitive system or user details	Credential and data leakage
21	CWE-306	Missing Authentication for Critical Function	Authentication	3.47	11	4	Leaves critical functions without identity verification	Unauthorized operations
22	CWE-918	Server-Side Request Forgery	Network Interaction	3.36	0	-3	Sends attacker-controlled internal requests	Cloud credential theft
23	CWE-77	Command Injection	Injection	3.15	2	-10	Injects command parameters into system operations	Host compromise
24	CWE-639	Authorization Bypass Using User-Controlled Key	Permission Checks	2.62	0	6	Uses attacker-controlled identifiers to bypass rules	Cross-user data exposure
25	CWE-770	Missing Resource Limits or Throttling	Resource Management	2.54	0	1	Allows resource exhaustion without limits	Denial of service

MITRE's CWE catalog reached 944 documented weaknesses and 1,450 total entries with the April 2026 release of CWE 4.20. The latest Top 25 ranking remains the 2025 edition, calculated from 39,080 CVE records, with cross-site scripting (CWE-79) retaining the No. 1 position at a score of 60.38.

How to Read the CWE Top 25 Table?

Rank gives an immediate indication of priority, but it does not explain the full significance of an entry. Score reflects the combined ranking value, KEV presence connects a weakness class with CVEs known to have been exploited, and movement shows how its position changed from the previous list.

Typical impact shows the likely technical outcome. Reading these fields together makes it easier to distinguish a frequently documented weakness from one carrying stronger exploitation pressure or more severe consequences.

Table Field	What It Means	How It Should Be Interpreted
Rank	Position in MITRE’s list	Higher placement signals stronger priority during review and remediation
CWE ID	Unique identifier for a flaw class	Useful for matching scanner results, advisories, and engineering tickets
Vulnerability Type	Plain-language issue name	Helps readers quickly understand the nature of the problem
Category	Broader technical group	Shows whether the issue comes from injection, memory handling, authentication, permissions, files, or resource limits
Score	Numerical ranking value	Higher scores usually reflect stronger combined prevalence and severity
CVEs in KEV	Known exploited CVEs tied to the entry	A larger count points to real attacker interest, not only theoretical risk
Rank Movement	Change from the previous list	Movement reveals whether a category is rising, falling, newly added, or stable
Why It’s Dangerous	Short risk explanation	Clarifies how attackers may abuse the condition in real systems
Typical Impact	Likely outcome after exploitation	Connects the flaw class with business and technical consequences

Types of Vulnerabilities in the CWE Top 25

Entries in the CWE Top 25 fall into several technical groups rather than one type of software defect. Injection changes how untrusted content is interpreted, memory corruption breaks process boundaries, permission failures weaken authorization decisions, file-handling errors affect stored content and paths, while resource exhaustion threatens service availability.

Injection Issues

Injection occurs after attacker-controlled data crosses into a browser, database, command shell, or interpreter without sufficient isolation from executable instructions. XSS alters browser-side processing, SQL injection changes database queries, and command or code injection manipulates server-side behavior. Session theft, data exposure, host compromise, and application takeover are among the resulting outcomes.

Memory Corruption Bugs

Invalid reads, writes, and object references account for several entries in the ranking:

Out-of-Bounds Write places information beyond assigned memory boundaries, leading to crashes or remote code execution.
Use-After-Free reuses memory after release, which can destabilize a process or alter program flow.
Out-of-Bounds Read retrieves contents beyond an assigned buffer, exposing information stored in adjacent memory.
Classic, stack-based, and heap-based buffer overflows corrupt separate memory regions and can cause crashes, privilege escalation, or attacker-controlled code execution.
NULL Pointer Dereference triggers failure through an invalid null reference and commonly results in denial of service.

Permission Failures

Authorization and authentication weaknesses affect decisions surrounding sensitive functions. Missing Authorization removes a required permission check entirely, whereas Incorrect Authorization applies the rule incorrectly.

Authorization Bypass Using User-Controlled Key introduces another route around intended restrictions through attacker-controlled identifiers. Missing Authentication for Critical Function concerns identity verification instead of role evaluation. Missing or incorrect identity and permission checks lead to IDOR, unauthorized actions, privilege abuse, and cross-user exposure.

File Handling Errors

Several CWE entries involve paths, uploaded content, stored information, or serialized objects:

Path Traversal uses crafted path strings to reach files outside approved directories.
Unrestricted File Upload places harmful files into application-controlled locations, creating opportunities for web shells or malware upload.
Information Exposure reveals confidential system or user details.
Deserialization of Untrusted Data interprets attacker-controlled serialized objects and may result in remote code execution.

Filename validation alone does not address all of these risks. Directory resolution determines which files a request can reach, storage placement controls where uploads land, executable permissions limit what those files can do, and object parsing determines how serialized content is handled.

Resource Exhaustion Gaps

Unrestricted requests, sessions, memory consumption, CPU usage, storage, or other expensive actions can exhaust available resources. A costly workload or sustained automated traffic may first degrade performance and eventually make the service unavailable. CWE-770 covers software that lacks resource limits or throttling, with denial of service as the primary impact represented in the ranking.

How Developers Can Reduce CWE Top 25 Exposure?

Developers reduce CWE Top 25 exposure most effectively by addressing these defects before code reaches production. Each safeguard should match the condition behind the weakness instead of applying one broad security rule across unrelated code paths.

Validate Input Boundaries

User submissions, API payloads, files, headers, and third-party content should be checked as they cross a trust boundary. Allowlists reject entries outside an approved set, type checks confirm expected formats, and length boundaries prevent oversized payloads. Context-aware encoding keeps validated content from being interpreted as executable browser markup or script.

Use Safer Query Patterns

Parameterized queries bind user-supplied data separately from database instructions, preventing it from altering the intended SQL structure. Stored procedures, ORM safeguards, and query builders maintain the same separation if developers avoid unsafe string construction and retain appropriate format checks.

Enforce Permission Logic

Privileged actions require role validation, ownership checks, and identity verification close to the function being performed. Centralized authorization functions reduce omissions caused by duplicated logic across routes, controllers, or services.

Negative testing is equally important. Requests from unauthorized roles and attempts to reference another user’s object should fail consistently, not only through the expected interface path.

Choose Memory-Safe Approaches

Memory-safe languages and bounds-checked abstractions remove many opportunities for invalid reads, writes, and pointer misuse. Native code still depends on careful memory allocation and pointer handling.

Fuzz testing uncovers unexpected memory states before release, while hardened libraries and compiler defenses limit the damage from defects that remain. Low-level components deserve particular scrutiny because a single boundary error can redirect program flow.

Control File and Object Flows

Upload pipelines need file-type checks, storage isolation, size caps, and restrictions against executable content. Path resolution deserves separate review because crafted traversal strings can direct file requests outside approved directories. Deserialization introduces another concern: attacker-controlled object structures influence program behavior during parsing in vulnerable implementations.

Add Resource Limits

Rate limits, quotas, timeouts, and payload caps stop expensive requests from consuming excessive CPU, memory, storage, or worker capacity. Upload endpoints, automated traffic, authentication requests, and long-running jobs consume backend resources in different ways, so thresholds should reflect the workload being handled rather than rely on one universal value.

CWE Top 25 vs OWASP Top 10 vs SANS Top 25

CWE, OWASP, and SANS are frequently discussed together because all three appear in software security programs. Their purposes, however, are different.

Framework	Main Focus	Best Use Case	Scope	Practical Value
CWE Top 25	Root error classes behind severe CVEs	Finding repeated coding and design mistakes	Broad software weakness classification	Guides code review, secure design, testing, and remediation priority
OWASP Top 10	Critical web application security risks	Training, awareness, and web app testing	Application-layer risk categories	Helps teams communicate common web risk areas in simple language
SANS Top 25	Dangerous software errors tied to CWE	Secure coding education and developer guidance	Programming, design, and architecture mistakes	Connects training material with high-impact weakness categories

CWE traces a finding back to its underlying coding or design error. OWASP organizes broader web application risk categories, while SANS emphasizes dangerous programming, design, and architecture mistakes for secure coding education.

Final Thoughts

CWE Top 25 works best as a decision framework rather than only a ranked reference list. Mapping individual findings to their underlying CWE category exposes implementation defects that may otherwise appear unrelated across scanner results, code reviews, and remediation tickets.

Small gaps in validation, permission logic, memory handling, file processing, and resource management can survive multiple releases if teams patch only the immediate vulnerability.

Grouping findings by CWE category makes technical debt easier to trace to its source. Teams can then correct both the current flaw and the development practice responsible for its return, improving review quality while lowering the chance of the same weakness appearing again in future software.