CWE Top 25
The CWE Top 25 is MITRE's annual ranking of the most dangerous software weaknesses. It's not a list of specific vulnerabilities. It's a list of weakness types, the recurring root causes behind thousands of real vulnerabilities each year.
CWE itself catalogs 944 weakness types. The Top 25 picks out the 25 that matter most, based on real-world data, not opinion.
How the ranking works
MITRE scores each weakness on two factors.
- Prevalence: how often it shows up across real, disclosed vulnerabilities.
- Severity: how much damage it tends to cause when exploited. The combined score sets the rank.
The 2025 edition drew on 39,080 CVE records, disclosed between June 2024 and June 2025. CISA and MITRE publish the list together, once a year.
The 2025 list: What's on top, what's new
Cross-Site Scripting holds the top spot again, as it has for multiple years running, while SQL Injection climbed to #2 and Cross-Site Request Forgery moved up to #3.
Six weaknesses are new to the 2025 list:
- Three buffer overflow variants (classic at #11, stack-based at #14, heap-based at #16),
- Improper access control (#19),
- Authorization bypass through a user-controlled key (#24), and
- Unrestricted resource allocation (#25).
Six weaknesses dropped off entirely, including improper privilege management, hardcoded credentials, and improper authentication, though dropping off doesn't mean the risk disappeared. It just means other weaknesses scored higher this year.
Why the CWE Top 25 matters
944 weakness types are too many to prioritize by hand. Most teams need a starting point, not the whole catalog.
CISA built its Secure by Design and Secure by Demand initiatives around this list. Vendors get benchmarked against it. Security teams tune testing around it. It's the practical entry point into a taxonomy too large to use directly.
CWE Top 25 vs. CWE
CWE is the full taxonomy: every weakness type MITRE tracks, organized by software development, hardware design, and research use.
The Top 25 is a yearly snapshot, a small, ranked slice of that taxonomy rebuilt each year from fresh CVE data. Where CWE tells you the type of a weakness, the Top 25 tells you which types to worry about first, this year.
For the full taxonomy, see What is CWE?
CWE Top 25 vs. OWASP Top 10
Both are "most critical" lists, but they rank different things.
OWASP Mobile Top 10 ranks ten risk categories specific to mobile apps, refreshed roughly every few years. CWE Top 25 ranks twenty-five weakness types across all software, refreshed every year straight from CVE data.
The two connect. OWASP's own Top Ten has been mapped to CWE identifiers since its 2004 edition. So, a finding tagged to a Top 25 CWE may also map to an OWASP Top 10 category. Two different lenses on the same overlapping ground.
For the mobile-specific list,
Check out: What is OWASP Mobile Top 10?
Where Appknox fits
Appknox tags every finding with a CWE ID already. When that ID appears in the current Top 25, the finding carries extra weight. Not just a weakness type; one MITRE and CISA rank among the most dangerous this year, based on real data.
See the full testing methodology: Appknox Automated Vulnerability Assessment.
Frequently asked questions
What is the CWE Top 25?
The CWE Top 25 is MITRE and CISA's annual ranking of the most dangerous software weakness types, based on real CVE data.
How is the CWE Top 25 ranked?
By a combined score of two factors: prevalence, how often a weakness shows up in disclosed vulnerabilities, and severity, how much damage it tends to cause.
What's #1 on the 2025 CWE Top 25?
Cross-Site Scripting, CWE-79. It's held the top spot for multiple years running.
How often is the CWE Top 25 updated?
The CWE Top 25 is updated once a year. Each edition draws on roughly twelve months of fresh CVE data.
What's the difference between the CWE Top 25 and CWE?
CWE is the full taxonomy, 944 weakness types. The Top 25 is a yearly, ranked subset: the 25 that matter most, based on real-world data.
Related: What is CWE? | What is OWASP Mobile Top 10? | Appknox Automated Vulnerability Assessment
By Aadarsh Anand, Security Researcher, Appknox Security Research Team
Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience mapping automated and manual testing findings to CWE and CWE Top 25 categories across financial services, healthcare, and enterprise mobile app portfolios.
This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.
.png)
