Top 25 Most Dangerous Software Weaknesses

Dec 11, 2025 | Government

This is the time of year where it seems everyone is releasing a list of the top items that appeared throughout the year and the federal government is no different.

Just issued was the 2025 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses. This annual list identifies the most critical weaknesses adversaries exploit to compromise systems, steal data, or disrupt services.

The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Homeland Security Systems Engineering and Development Institute (HSSEDI), operated by the MITRE Corporation, released the list.

RELATED STORIES

Prioritizing the weaknesses outlined in the Top 25 is integral to CISA’s Secure by Design and Secure by Demand initiatives, which promote building and procuring secure technology solutions.

CISA and MITRE encourage organizations to review this list and use it to inform their respective software security strategies.

Schneider Bold
List Goals

The goal behind this list of the 2025 CWE Top 25 is to help:

  • Support vulnerability reduction: By focusing on the Top 25, organizations can prioritize lifecycle changes, adopt safer architectural decisions, and reduce high-impact vulnerabilities related to injection, access control, and memory safety defects.
  • Drive cost efficiencies: Eliminating weaknesses early reduces downstream remediation; addressing them before deployment is more efficient and cost effective than patching, reconfiguring, or responding to emergency incidents.
  • Strengthen customer and stakeholder trust: Transparent efforts to identify, mitigate, and monitor weaknesses demonstrate commitment to Secure by Design principles. Organizations that prioritize eliminating recurring weaknesses contribute to a safer software ecosystem.
  • Promote consumer awareness: The Top 25 empowers consumers to understand underlying causes of common vulnerabilities, supports more informed purchasing decisions, and encourages adoption of products that follow robust security engineering practices.

CISA and Mitre recommend stakeholders do the following:

  • Developers and product teams: Review the 2025 CWE Top 25 to identify high-priority weaknesses and adopt Secure by Design practices in development.
  • Security teams: Incorporate the Top 25 into vulnerability management and application security testing to assess and mitigate critical weaknesses.
  • Procurement and risk managers: Use the Top 25 as a benchmark when evaluating vendors and apply Secure by Demand guidelines to ensure investment in secure products.

CISA and MITRE reinforce collective efforts to reduce vulnerabilities at the source, strengthen national cybersecurity, and improve long-term resilience. This is their way of shining a light on the most dangerous software weaknesses. 

Top 25

The following are the top 25 most dangerous software weaknesses:

  1. Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CWE-79 CVEs in KEV: 7 Rank Last Year: 1
  2. Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) CWE-89 CVEs in KEV: 4 Rank Last Year: 3 (up 1)
  3. Cross-Site Request Forgery (CSRF) CWE-352 CVEs in KEV: 0 Rank Last Year: 4 (up 1)
  4. Missing Authorization CWE-862 CVEs in KEV: 0 Rank Last Year: 9 (up 5)
  5. Out-of-bounds Write CWE-787 CVEs in KEV: 12 Rank Last Year: 2 (down 3)
  6. Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) CWE-22 CVEs in KEV: 10 Rank Last Year: 5 (down 1)
  7. Use After Free CWE-416 CVEs in KEV: 14 Rank Last Year: 8 (up 1)
  8. Out-of-bounds Read CWE-125 CVEs in KEV: 3 Rank Last Year: 6 (down 2)
  9. Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) CWE-78 CVEs in KEV: 20Rank Last Year: 7 (down 2)
  10. Improper Control of Generation of Code (‘Code Injection’) CWE-94 CVEs in KEV: 7Rank Last Year: 11 (up 1)
  11. Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) CWE-120 CVEs in KEV: 0 Rank Last Year: N/A
  12. Unrestricted Upload of File with Dangerous Type CWE-434 CVEs in KEV: 4 Rank Last Year: 10 (down 2)
  13. NULL Pointer Dereference CWE-476C VEs in KEV: 0 Rank Last Year: 21 (up 8)
  14. Stack-based Buffer Overflow CWE-121 CVEs in KEV: 4 Rank Last Year: N/A
  15. Deserialization of Untrusted Data CWE-502 CVEs in KEV: 11 Rank Last Year: 16 (up 1)
  16. Heap-based Buffer Overflow CWE-122 CVEs in KEV: 6 Rank Last Year: N/A
  17. Incorrect Authorization CWE-863 CVEs in KEV: 4 Rank Last Year: 18 (up 1)
  18. Improper Input Validation CWE-20 CVEs in KEV: 2 Rank Last Year: 12 (down 6)
  19. Improper Access Control CWE-284 CVEs in KEV: 1 Rank Last Year: N/A
  20. Exposure of Sensitive Information to an Unauthorized Actor CWE-200 CVEs in KEV: 1 Rank Last Year: 17 (down 3)
  21. Missing Authentication for Critical Function CWE-306 CVEs in KEV: 11 Rank Last Year: 25 (up 4)
  22. Server-Side Request Forgery (SSRF) CWE-918 CVEs in KEV: 0 Rank Last Year: 19 (down 3)
  23. Improper Neutralization of Special Elements used in a Command (‘Command Injection’) CWE-77 CVEs in KEV: 2 Rank Last Year: 13 (down 10)
  24. Authorization Bypass Through User-Controlled Key CWE-639 CVEs in KEV: 0 Rank Last Year: 30 (up 6)
  25. Allocation of Resources Without Limits or Throttling CWE-770 CVEs in KEV: 0 Rank Last Year: 26 (up 1)

Submit a Comment

Your email address will not be published. Required fields are marked *

Pin It on Pinterest

Share This