Who publishes the CWE Top 25?

MITRE publishes the CWE Top 25 annually, with sponsorship from CISA, as part of the broader CWE program.

Is the CWE Top 25 the same as the OWASP Top 10?

No. The CWE Top 25 ranks weakness types across all software using CVE and NVD data, while the OWASP Top 10 lists the top risk categories for web applications.

How often does the list change?

It is recalculated each year from recent CVE and NVD data, so rankings shift between editions as the threat landscape and methodology evolve.

What data drives the ranking?

CVE records from the NVD, their CWE mappings, CVSS severity scores, and, in recent editions, signals from the CISA KEV catalog of known exploited vulnerabilities.

What is the CWE Top 25 Most Dangerous Software Weaknesses?

Last reviewed June 2, 2026

The CWE Top 25 Most Dangerous Software Weaknesses is an annual list, published by MITRE, of the 25 weakness types that are most common and most impactful. It is data-driven: weaknesses are scored using real-world CVE and NVD data (including CVSS severity and CISA KEV signals) to rank the flaws that pose the greatest current risk.

What the CWE Top 25 is

The CWE Top 25 Most Dangerous Software Weaknesses is a curated CWE view that MITRE publishes each year. It highlights the 25 weakness types that, based on observed data, are both frequently occurring and capable of serious impact. The goal is to give developers, security teams, and managers a focused, prioritized starting point for reducing risk.

Because it is built from CWE entries, the list names weakness types (for example, CWE-79 Cross-site Scripting or CWE-787 Out-of-bounds Write), not specific products or bugs.

How the list is calculated

The ranking is data-driven rather than opinion-based. MITRE analyzes CVE records from the National Vulnerability Database (NVD) over a recent period, looks at how each CVE maps to a CWE, and combines the frequency of each weakness with the average severity of its CVEs (using CVSS). Recent versions of the methodology also factor in whether the weakness appears in vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The result is a scored, ranked list that reflects which weakness types are actually driving dangerous, real-world vulnerabilities in the analysis window. Because the inputs change each year, rankings shift between editions.

Typical entries

CWE-787 - Out-of-bounds Write, a recurring top entry due to its prevalence and impact.
CWE-79 - Cross-site Scripting (XSS).
CWE-89 - SQL Injection.
CWE-416 - Use After Free.
CWE-22 - Path Traversal.

How to use the CWE Top 25

Treat the Top 25 as a prioritized backlog for prevention. Map your own CVEs to their CWEs, see which Top 25 weaknesses appear most in your environment, and target secure-coding controls, code review, and testing at those patterns first.

It pairs well with the OWASP Top 10: the CWE Top 25 covers weakness types across all software, while the OWASP Top 10 frames the top risk categories specifically for web applications.

Keep exploring

Frequently asked questions

Who publishes the CWE Top 25?: MITRE publishes the CWE Top 25 annually, with sponsorship from CISA, as part of the broader CWE program.
Is the CWE Top 25 the same as the OWASP Top 10?: No. The CWE Top 25 ranks weakness types across all software using CVE and NVD data, while the OWASP Top 10 lists the top risk categories for web applications.
How often does the list change?: It is recalculated each year from recent CVE and NVD data, so rankings shift between editions as the threat landscape and methodology evolve.
What data drives the ranking?: CVE records from the NVD, their CWE mappings, CVSS severity scores, and, in recent editions, signals from the CISA KEV catalog of known exploited vulnerabilities.