The 2025 CWE Top 25 ranks cross-site scripting first with a score of 60.38, then SQL injection at 28.72, cross-site request forgery at 13.64, missing authorization at 13.28 and out-of-bounds write at 12.68. MITRE updated the list on 15 December 2025. Below is the full ranking with a plain meaning and a fix.
How is the list built?
MITRE publishes the CWE Top 25 Most Dangerous Software Weaknesses. The ranking is scored from published CVE records, and the page links to a separate methodology document that we did not read. Treat the scores as relative weight within the list, not as probabilities (MITRE).
It ranks weakness types in published vulnerabilities. It does not tell you what attackers are exploiting this week, and your own stack may differ.
The ranking
| Rank | CWE | Weakness | Score |
|---|---|---|---|
| 1 | CWE-79 | Cross-site scripting | 60.38 |
| 2 | CWE-89 | SQL injection | 28.72 |
| 3 | CWE-352 | Cross-site request forgery | 13.64 |
| 4 | CWE-862 | Missing authorization | 13.28 |
| 5 | CWE-787 | Out-of-bounds write | 12.68 |
| 6 | CWE-22 | Path traversal | 8.99 |
| 7 | CWE-416 | Use after free | 8.47 |
| 8 | CWE-125 | Out-of-bounds read | 7.88 |
| 9 | CWE-78 | OS command injection | 7.85 |
| 10 | CWE-94 | Code injection | 7.57 |
| 11 | CWE-120 | Classic buffer overflow | 6.96 |
| 12 | CWE-434 | Unrestricted upload of dangerous file type | 6.87 |
| 13 | CWE-476 | NULL pointer dereference | 6.41 |
| 14 | CWE-121 | Stack-based buffer overflow | 5.75 |
| 15 | CWE-502 | Deserialization of untrusted data | 5.23 |
| 16 | CWE-122 | Heap-based buffer overflow | 5.21 |
| 17 | CWE-863 | Incorrect authorization | 4.14 |
| 18 | CWE-20 | Improper input validation | 4.09 |
| 19 | CWE-284 | Improper access control | 4.07 |
| 20 | CWE-200 | Exposure of sensitive information | 4.01 |
| 21 | CWE-306 | Missing authentication for critical function | 3.47 |
| 22 | CWE-918 | Server-side request forgery | 3.36 |
| 23 | CWE-77 | Command injection | 3.15 |
| 24 | CWE-639 | Authorization bypass through user-controlled key | 2.62 |
| 25 | CWE-770 | Allocation of resources without limits | 2.54 |
What do they group into?
Injection and output handling (79, 89, 78, 94, 77, 22). Untrusted input reaches an interpreter, a file path or a page. The fix is the same idea each time: keep data and code separate. Use parameterised queries, context-aware output encoding and allow lists for paths.
Memory safety (787, 416, 125, 120, 121, 122, 476). Seven entries are memory errors in languages that do not check bounds. Where you can, use a memory-safe language for new code, and enable compiler and runtime protections for the old code.
Authorization and access (862, 863, 284, 306, 639). Five entries are about who may do what. Missing and incorrect authorization are different bugs: one has no check, the other checks the wrong thing. Enforce checks on the server for every object, not just in the interface.
Request forgery (352, 918). CSRF tricks a browser into acting as the user. SSRF tricks a server into making requests for the attacker. Use anti-forgery tokens and same-site cookies for the first, and egress allow lists for the second.
Everything else. Upload handling (434), deserialization (502), weak validation (20), data exposure (200) and missing limits (770).
How should engineers use it?
As a checklist for code review and a map for training, not a to-do list to clear. Match each weakness to a test: a static rule, a unit test, a fuzz target or a dynamic scan. Then check whether your tools actually catch the top ten in your language.
What to do
- Pick the ten entries most relevant to your languages and frameworks.
- For each, write one review question and one automated check.
- Run a static scan and see which of these it reports.
- Add authorization tests for every endpoint that returns an object by ID.
- Move parsing and file handling into libraries with safe defaults.
- Re-read the list each December when MITRE updates it.
Quick check
What is the most common weakness type in the 2025 list?
Cross-site scripting, CWE-79, with a score of 60.38, ahead of SQL injection at 28.72.
Does a high rank mean a weakness is more severe?
No. The ranking reflects how often and how seriously a weakness appears in published CVE records. Severity of a single bug depends on context.
Sources
Last reviewed: 18 October 2026.
