The 2025 CWE Top 25 Most Dangerous Software Weaknesses is a ranked list published by MITRE’s Common Weakness Enumeration (CWE) program. Each weakness gets a score, a count of CVEs in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and a rank change against 2024. Cross-site scripting ranks first. This post covers the top 10 and what the CWE KEV insights page adds.
What is the CWE Top 25 and how is it scored?
The CWE site describes the Top 25 as “an annual list of the most common and impactful software weaknesses.” A weakness, in CWE terms, is a condition in a software, firmware, hardware or service component that could contribute to the introduction of vulnerabilities. CWEs describe the root causes of vulnerabilities.
The methodology weighs “prevalence” by the number of CVE Records whose root causes correlate with a CWE, and “severity” by the average CVSS score of those CVE Records. The Top 25 page was last updated on December 15, 2025.
Which weaknesses make the 2025 top 10?
The list below is the top 10 of the 2025 list as MITRE publishes it. For each entry: rank, CWE id, name, score, CVEs in KEV, and the rank change against 2024.
- 1. CWE-79, Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’). Score 60.38, 7 CVEs in KEV, rank change 0.
- 2. CWE-89, Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’). Score 28.72, 4 CVEs in KEV, rank change +1.
- 3. CWE-352, Cross-Site Request Forgery (CSRF). Score 13.64, 0 CVEs in KEV, rank change +1.
- 4. CWE-862, Missing Authorization. Score 13.28, 0 CVEs in KEV, rank change +5.
- 5. CWE-787, Out-of-bounds Write. Score 12.68, 12 CVEs in KEV, rank change -3.
- 6. CWE-22, Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’). Score 8.99, 10 CVEs in KEV, rank change -1.
- 7. CWE-416, Use After Free. Score 8.47, 14 CVEs in KEV, rank change +1.
- 8. CWE-125, Out-of-bounds Read. Score 7.88, 3 CVEs in KEV, rank change -2.
- 9. CWE-78, Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’). Score 7.85, 20 CVEs in KEV, rank change -2.
- 10. CWE-94, Improper Control of Generation of Code (‘Code Injection’). Score 7.57, 7 CVEs in KEV, rank change +1.
- 60.38Score of CWE-79, cross-site scripting, rank 1 in the 2025 Top 25Source: MITRE CWE, 2025 CWE Top 25 and Top 10 KEV insights
- 20CVEs in KEV listed for CWE-78, OS command injection, rank 9Source: MITRE CWE, 2025 CWE Top 25 and Top 10 KEV insights
- 182CVE Records from the KEV catalog included in the KEV list calculationSource: MITRE CWE, 2025 CWE Top 25 and Top 10 KEV insights
What stands out in the rankings?
Cross-site scripting holds first place with a rank change of 0 and a score of 60.38. SQL injection follows at 28.72, which is the second score on the list, and the third is 13.64 for CSRF. Missing Authorization shows the largest rise in the top 10, at +5. Out-of-bounds Write fell 3 places to rank 5.
The KEV column tells a different story from the score column. CSRF and Missing Authorization each list 0 CVEs in KEV. OS command injection lists 20, use after free 14, and out-of-bounds write 12. Readers who want to learn more about the first entry can read the glossary entry on cross-site scripting.
What does the KEV insights page add?
CISA began publishing the KEV catalog in 2021. Its entries are vulnerabilities that are “observed to be (or have been) actively exploited.” The CWE page says that coupling the Top 25 with knowledge of exploitation activity “offers a valuable, additional perspective for operational vulnerability management.”
For the KEV list, 182 CVE Records were included: all CVE Records in the KEV catalog from June 2024 and June 2025, as of January 15, 2026. It used the same scoring methodology as the Top 25. The insights page was last updated on January 29, 2026.
That list ranks the weaknesses differently. The first four of the 2025 Top 10 KEV Weaknesses are shown below next to their Top 25 rank, with cross-site scripting, which is tenth on the KEV list, at the other end.
| Weakness | 2025 CWE Top 25 rank | 2025 Top 10 KEV rank |
|---|---|---|
| CWE-78 OS command injection | 9th | 1st |
| CWE-416 Use after free | 7th | 2nd |
| CWE-787 Out-of-bounds write | 5th | 3rd |
| CWE-306 Missing authentication for critical function | 21st | 4th |
| CWE-79 Cross-site scripting | 1st | 10th |
The KEV list also holds CWE-502 Deserialization of Untrusted Data (5th, against 15th in the Top 25), CWE-288 Authentication Bypass Using an Alternate Path or Channel (8th, not in the Top 25), and CWE-122 Heap-based Buffer Overflow (9th, against 16th).
Which categories lead the KEV weaknesses?
The CWE page groups the KEV list using View-1400, which sorts entries into 22 categories. Only 5 of the 22 appear. Injection (#1, #7 and #10) and Memory Safety (#2, #3 and #9) are the top two, with three weaknesses each. Access Control has two (#4 and #8). Resource Control and File Handling have one each (#5 and #6).
Why might KEV data under-count some weaknesses?
The CWE page lists several limits. It says exploit detection techniques “might not be as mature for some CWEs,” which could lead to under-reporting. Its example is CSRF (CWE-352): part of the attack occurs outside the defender’s network, so traffic monitoring may not detect it. Some KEV entries may not map to sufficiently low-level CWEs, and some CVE descriptions have too little detail to map at all.
The page also gives reasons the two lists may differ, such as whether a weakness is easily found by code scanning tools, is relatively easy to exploit, or has a desirable impact for adversaries, for example code execution.
Where to read more
For exploitation data from the first half of 2026, see vulnerability exploitation trends in H1 2026. For the volume side of the problem, see CVE volume and risk prioritization.
Two linked pieces cover this from other angles: CVSS, EPSS and KEV signals and exploited vulnerabilities in 2025.