MITRE has shared this year's top 25 list of the most dangerous software weaknesses behind over 39,000 security vulnerabilities disclosed between June 2024 and June 2025.

The list was released in cooperation with the Homeland Security Systems Engineering and Development Institute (HSSEDI) and the Cybersecurity and Infrastructure Security Agency (CISA), which manage and sponsor the Common Weakness Enumeration (CWE) program.

Software weaknesses can be flaws, bugs, vulnerabilities, or errors found in a software's code, implementation, architecture, or design, and attackers can abuse them to breach systems running the vulnerable software. Successful exploitation allows threat actors to gain control over compromised devices and trigger denial-of-service attacks or access sensitive data.

To create this year's ranking, MITRE scored each weakness based on its severity and frequency after analyzing 39,080 CVE Records for vulnerabilities reported between June 1, 2024, and June 1, 2025.

While Cross-Site Scripting (CWE-79) still retains its spot at the top of the Top 25, there were many changes in rankings from last year's list, including Missing Authorization (CWE-862), Null Pointer Dereference (CWE-476), and Missing Authentication (CWE-306), which were the biggest movers up the list.

The new entries in this year's top-most severe and prevalent weaknesses are Classic Buffer Overflow (CWE-120), Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122), Improper Access Control (CWE-284), Authorization Bypass Through User-Controlled Key (CWE-639), and Allocation of Resources Without Limits or Throttling (CWE-770).

"Often easy to find and exploit, these can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working," MITRE said.

"This annual list identifies the most critical weaknesses adversaries exploit to compromise systems, steal data, or disrupt services. CISA and MITRE encourage organizations to review this list and use it to inform their respective software security strategies," the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added.

In recent years, CISA has issued multiple "Secure by Design" alerts spotlighting the prevalence of widely documented vulnerabilities that remain in software despite available mitigations.

Some of these alerts have been released in response to ongoing malicious campaigns, such as a July 2024 alert asking tech companies to eliminate path OS command injection weaknesses exploited by the Chinese Velvet Ant state hackers in attacks targeting Cisco, Palo Alto, and Ivanti network edge devices.

This week, the cybersecurity agency advised developers and product teams to review the 2025 CWE Top 25 to identify key weaknesses and adopt Secure by Design practices, while security teams were asked to integrate it into their app security testing and vulnerability management processes.

In April 2025, CISA also announced that the U.S. government had extended MITRE's funding for another 11 months to ensure continuity of the critical Common Vulnerabilities and Exposures (CVE) program, following a warning from MITRE VP Yosry Barsoum that government funding for the CVE and CWE programs was set to expire.