Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
MITRE’s 2025 CWE Top 25 ranks software weakness types using a score that combines how often they appear in vulnerability records with the average severity of those vulnerabilities. Cross-site scripting ranks first, followed by SQL injection, cross-site request forgery, missing authorization, and out-of-bounds write. The list is useful for prioritizing secure-development work, but it is not a live threat feed, a forecast, or a security rating for any particular product.
What the 2025 CWE Top 25 ranks
The Common Weakness Enumeration (CWE) is a catalogue of software and hardware weakness types. MITRE’s Top 25 is a ranked subset associated with public Common Vulnerabilities and Exposures (CVE) records. MITRE describes it as showing currently common and impactful software weaknesses. The 2025 edition’s dataset contains 39,080 CVE records published from June 1, 2024, through June 1, 2025. MITRE’s Top 25 overview explains the list’s intended uses; the 2025 methodology describes the dataset and calculations.
Each row is a weakness category, not a specific bug, vulnerable product, or attack in progress. A high rank signals that a weakness appears frequently in the records used and is associated with serious vulnerabilities on average. It does not establish how exposed a particular application is.
What the top five show
The official 2025 table reports these top-ranked weaknesses and separate counts of CVEs that appear in CISA’s Known Exploited Vulnerabilities (KEV) catalog. The score and KEV count measure different things.
#1 Best Overall
| Rank | Weakness | Score | Mapped CVEs in KEV |
|---|---|---|---|
| 1 | CWE-79: improper neutralization of input during web page generation (cross-site scripting) | 60.38 | 7 |
| 2 | CWE-89: improper neutralization of special elements used in an SQL command (SQL injection) | 28.72 | 4 |
| 3 | CWE-352: cross-site request forgery (CSRF) | 13.64 | 0 |
| 4 | CWE-862: missing authorization | 13.28 | 0 |
| 5 | CWE-787: out-of-bounds write | 12.68 | 12 |
These are the edition’s reported values, not current incident counts. The KEV column counts mapped CVEs included in CISA’s known-exploited catalog; a zero there means none of the CVEs mapped to that row were in that catalog for this table, not that the weakness is harmless or impossible to exploit. See the official 2025 ranking for the full list and its column definitions.
How the danger score works
MITRE calculates a frequency score and a severity score, normalizes each relative to the minimum and maximum values in the dataset, then multiplies them and scales the result by 100. Severity is based on the average CVSS v3.0 or v3.1 base score for mapped CVEs; records scored with other CVSS versions are excluded from that calculation because base-score versions differ. The result rewards weaknesses that are both frequent and consequential rather than allowing a rare, severe issue or a common, lower-impact issue to dominate on one factor alone. MITRE’s methodology provides the calculation details.
So the score is not simply a count of flaws, a severity rating for one bug, or a measure of active exploitation. That last question is represented separately by the KEV count in the table.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why 2025 ranks are not a clean year-over-year comparison
The most important change is how MITRE handled CWE mappings. Earlier editions normalized mappings to View-1003, a simplified set of 130 weaknesses used by NVD for enrichment. This could roll specific child weaknesses into broader parent categories or exclude entries without a valid View-1003 ancestor. In 2025, after reviewing mappings, MITRE used the CWE mappings as provided rather than normalizing all of them to that view. This makes more specific weaknesses visible and changes the basis for comparison with older editions.
Mapping quality also received attention. MITRE scoped 9,468 records—24% of the 39,080-record dataset—for possible remapping, across 281 CVE Numbering Authorities (CNAs). It received CNA feedback on 2,459 records from 170 CNAs. For the first time, a grounded large language model tool provided additional mapping suggestions for human and CNA review; MITRE describes these as suggestions, not automatic final assignments. The process also examined abstract or commonly misused mappings, differences from an internal keyword matcher, and cases where a parent and child CWE were both mapped to one record.
MITRE’s 2025 Key Insights reports that, among 28,336 mappings associated with the Top 25, 79.19% were “Allowed,” 15.40% “Allowed-with-Review,” and 5.42% “Discouraged.” The corresponding 2024 proportions were 82.33%, 7.48%, and 10.19%. These percentages describe mapping-use categories, not the prevalence of weaknesses in software. MITRE also reports that the share of dataset CVE records with a CWE mapping from the publishing CNA rose from 53% in the 2024 dataset to 67% in the 2025 dataset—a 14-percentage-point difference. See the 2025 Key Insights for those comparisons.
Rank #4
These methodological changes help explain why rank movement should not automatically be read as a sudden real-world increase or decrease. For example, MITRE says CWE-269 had 219 CVEs in non-normalized 2025 data, while its child CWE-250 had 88; rolling child mappings into CWE-269 would have produced 633 mappings and might have kept CWE-269 in the Top 25. MITRE notes that mapping changes likely explain many shifts, while other factors—including more annual CVE records and fewer NVD mappings in 2024—also matter. The ranking alone does not isolate the cause of each movement.
What changed in the rankings
Several entries moved notably in the published 2025 ranking: missing authorization (CWE-862) rose from #9 to #4; NULL Pointer Dereference (CWE-476) moved from #21 to #13; and Missing Authentication for Critical Function (CWE-306) moved from #25 to #21. New appearances included classic buffer overflow (CWE-120) at #11, stack-based buffer overflow (CWE-121) at #14, heap-based buffer overflow (CWE-122) at #16, and improper access control (CWE-284) at #19. These describe changes in the published list; given the mapping and dataset differences, they are not proof that those weakness types suddenly became more common.
Best Value
How developers and security teams can use the list
Use the ranking as a starting point for questions and reviews, not as a substitute for a threat model or assessment of your own systems. MITRE identifies vulnerability reduction, trend analysis, exploitability insights, customer trust, and investment decisions among possible uses.
- Prioritize review topics. Check whether high-ranked classes such as injection, authorization failures, or memory-safety errors are relevant to your languages, architecture, and exposed features.
- Translate broad categories into actionable causes. MITRE recommends Base and Variant CWE entries when they accurately describe the issue because they are more specific. Use a Class entry when no accurate Base or Variant is available; Pillar entries are rarely useful for root-cause mapping.
- Check your own evidence. Review code, design decisions, testing results, and incident information for the systems you actually operate. Aggregate public CVE records cannot determine your local exposure.
- Keep exploitation data separate. Use the KEV count as a signal about known exploitation represented in the catalog, not as the Top 25 score or a complete account of exploitation.
The list cannot by itself prove that a vendor is secure or insecure, predict the next attack, or measure every software flaw. Its conclusions are bounded by public CVE records, their CWE mappings, the publication window, and the scoring choices for this edition.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
