MITRE’s New CWE 25 List Released

The US government has published a list of the most common and impactful software weaknesses of the past two years.

The CWE Top 25 list was announced by the Homeland Security Systems Engineering and Development Institute, sponsored by the DHS and operated by non-profit MITRE.

Software weaknesses are errors, bugs, flaws and more that can lead to vulnerabilities. Unlike the Common Vulnerabilities and Exposures (CVE) system, which provides a number for each discovered vulnerability, Common Weakness Enumeration (CWE) is more like a glossary of generic weakness types. In other words, it refers to types of software weakness rather than specific vulnerabilities.

Out-of-bounds write tops the list, followed by cross-site scripting and SQL injection. An attacker can often exploit these vulnerabilities to take control of an affected system, steal data, or prevent applications from working.

CISA urged developers and product security teams to review the top 25 list and decide which of the recommended mitigations to adopt. It explained that more articles will be published over the coming weeks to explain the methodology for calculating the top 25, vulnerability mapping trends and more.

CWEs are becoming increasingly important as developers and security teams look to avoid the root causes that can become vulnerabilities. In 2022, a record number (25,096) of CVEs were published to the NVD. This was a 25% year-on-year increase and the sixth year in a row that the volume of newly discovered vulnerabilities hit an all-time high.