The MITRE Corporation has sounded its annual alarm, publishing its latest list of the most critical software weaknesses of the last year.

A roundup of the most severe and prevalent vulnerabilities behind the more than 39,000 CVE records in MITRE’s 2025 dataset, the yearly list has become a valuable resource for developers and cyber pros, acting as a strategic guide for making decisions around software and security.

According to MITRE, the findings not only help to reduce vulnerabilities that can result in hackers seizing control of systems, stealing data or crippling applications, but also introduce transparency into the security process, building confidence in product security. 

Retaining its spot at the top of the list is CWE-79, Cross-site Scripting, which allows attackers to run malicious scripts in other users’ browsers by taking advantage of systems that fail to properly clean previous user input before showing it on a web page.

Meanwhile, CWE-89 (SQL Injection), the second most critical software weakness, happens when malicious SQL code is inserted into an application’s input fields, letting attackers inject commands into a database and potentially allow them to gain hold of sensitive data.

Rounding out this year’s top three vulnerabilities, CWE-352, Cross-Site Request Forgery, is a web security weakness where attackers trick a user’s browser into sending unintended requests to a trusted site, exploiting the fact that browsers automatically include authentication details like cookies.

Among the biggest shifts in MITRE’s 2025 ranking were CWE-862 (Missing Authorisation), climbing five places to #4, CWE‑476 (Null Pointer Dereference) jumping eight spots to #13, and CWE‑306 (Missing Authentication) rising four places to #21, highlighting gaps in access control and coding practices that continue to dominate the security landscape.

Falling off the list were CWE-269 (Improper Privilege Management), CWE-190 (Integer Overflow or Wraparound), and CWE-287 (Improper Authentication), reflecting shifts in industry focus and mitigation efforts, though their decline doesn’t mean that the risks they pose are gone.

Recommended reading

• Report: Half of All Enterprise Passwords Vulnerable to Cracking
• Report: Cyber Breaches Are Tanking Share Prices
• Cyber-crime Costs to Hit $1.2tn in 2025, New Report Warns

Fresh faces also broke into the top 25, including CWE‑120 (Classic Buffer Overflow), which debuted at #11, while Stack‑based (CWE‑121) and Heap‑based (CWE‑122) Buffer Overflows entered at #14 and #16, respectively, an arrival that signals memory handling flaws remain a critical concern.

“Uncovering the technical root causes of these vulnerabilities serves as a powerful guide for investments, policies, and practices to prevent these vulnerabilities from occurring in the first place,” said MITRE.

“Often easy to find and exploit, these can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working.”