The Common Weaknesses Enumeration project has released their 2020 list of the 25 most dangerous software vulnerabilities.  The list describes the types of vulnerabilities that have resulted in CVE being issued over the last two years.

The project describes itself as:

The 2020 Common Weakness Enumeration (CWE™) Top 25 Most Dangerous Software Weaknesses (CWE Top 25) is a demonstrative list of the most common and impactful issues experienced over the previous two calendar years. These weaknesses are dangerous because they are often easy to find, exploit, and can allow adversaries to completely take over a system, steal data, or prevent an application from working.

Security Managers and Development Managers who appreciate the risks described in the CWE top 25 list are able to make more informed choices about how to allocate limited resources for security testing and monitoring.  Because the CWE list is weighted to include the severity or impact of a vulnerability – not simply the number of times it has been reported – it is possible to get an appreciation of the risks posed by different types of vulnerability.

Penetration testers and source code reviews are able to ensure the high-risk, high-impact areas receive appropriate focus to ensure vulnerabilities in your systems are identified and corrected.

For example, Cross-site scripting moved up from number 2 in 2019 to the top spot in the 2020 list indicating a rise in the risk posed by this type of vulnerability and the memory corrupting Out-of-bounds Write jumped from 12^th in 2019 up to 2^nd place in the 2020 list.

The top 3 vulnerabilities in the 2020 list are: