CWE Top 25 Most Dangerous Software Weaknesses, explained

The CWE Top 25 Most Dangerous Software Weaknesses is an annual, data-driven ranking published by The MITRE Corporation under sponsorship from CISA, as part of the Common Weakness Enumeration (CWE) program. MITRE's own description frames the purpose directly: these weaknesses are "often easy to find and exploit" and "can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working." Unlike a vulnerability database entry for one specific flaw, each CWE in the list is a class of weakness — the root cause pattern behind many individual CVEs — which is what makes the list useful for prioritizing where secure-coding effort and review time go, rather than reacting one CVE at a time.

How the score is calculated

MITRE's published methodology defines the danger score for each CWE as:

Score(CWE_X) = Fr(CWE_X) × Sv(CWE_X) × 100

• Frequency Fr(CWE_X) — how often that CWE is mapped to a CVE Record in the NVD dataset for the analysis window, normalized between the minimum and maximum frequency observed across all CWEs.
• Severity Sv(CWE_X) — the average CVSS base score (v3.0/v3.1 only) across CVEs mapped to that CWE, normalized the same way.

MITRE states this multiplication is deliberate: "weaknesses that are both common and caused significant harm will receive the highest scores," while a weakness whose exploitation "was of low impact will not receive a high Severity score, regardless of how common it was in the dataset." A weakness has to be both common and severe to rank highly — high frequency alone, or high severity alone, isn't enough.

What the current (2025) analysis covered

Per MITRE's 2025 methodology page, the current list analyzed 39,080 CVE Records published between 1 June 2024 and 1 June 2025. Of those, 9,468 records (24%) were flagged for expert remapping, and 2,459 (26% of the flagged set) received review from CVE Numbering Authorities (CNAs) before final scores were computed. MITRE documents two methodology changes introduced for 2025: CWE mappings were used "as provided, without normalizing them back to View-1003" (a simplified mapping view used in prior years), and an LLM-based tool assisted with mapping suggestions during remapping for the first time. Both changes mean 2025 scores and rankings are not perfectly comparable, year over year, to the 2024 list computed under the prior methodology.

The current ranked list (top ten)

Rank	CWE-ID	Name	Score
1	CWE-79	Cross-Site Scripting	60.38
2	CWE-89	SQL Injection	28.72
3	CWE-352	Cross-Site Request Forgery (CSRF)	13.64
4	CWE-862	Missing Authorization	13.28
5	CWE-787	Out-of-bounds Write	12.68
6	CWE-22	Path Traversal	8.99
7	CWE-416	Use After Free	8.47
8	CWE-125	Out-of-bounds Read	7.88
9	CWE-78	OS Command Injection	7.85
10	CWE-94	Code Injection	7.57

MITRE publishes the full 25-entry list, with scores, on its own site (linked in Sources below) — treat any specific rank or score as current as of the 2025 edition rather than permanent; MITRE re-runs the analysis annually against a fresh CVE window.

Using the list without over-reading it

The Top 25 ranks classes of weakness, not specific products or vendors, and the ranking reflects what was reported and scored in the public CVE dataset during the analysis window — a weakness that's genuinely common in embedded or industrial code but under-reported to CVE (because fewer researchers look at that code, or fewer vendors file CVEs for it) can rank lower than its real-world prevalence would suggest. The list is best used as a starting checklist for secure-code review and static analysis rule prioritization, not as a complete map of where risk actually concentrates in any one codebase — teams should still weigh it against their own CVE history and against vulnerability-specific prioritization data (see our KEV + EPSS prioritization guide and CVSS v4 vs v3.1 guide) rather than treating rank order alone as a remediation queue.

SoftWSP's device and firmware scanning can map findings in a specific firmware image or codebase against named CWE classes like these, rather than leaving teams to cross-reference MITRE's list by hand: see device & firmware security services.

This guide summarises a public MITRE/CISA-sponsored CWE program publication; it does not constitute legal or compliance advice.