MITRE's 2025 ranking, with examples and mitigations for exam prep
See also: OWASP Top 10 Reference
MITRE's annual ranking of the software weaknesses behind the most common and most severe publicly reported vulnerabilities. It is built from real CVE data rather than expert opinion: each weakness is scored on how often it is the root cause of a CVE and how severe those CVEs are. Where the OWASP Top 10 groups web risks into ten broad categories, the CWE Top 25 names specific, precisely defined weaknesses across every kind of software, including memory-unsafe code in operating systems, firmware and embedded devices.
A CWE (Common Weakness Enumeration) entry describes a type of mistake in code or design, such as missing authorization. A CVE describes one specific vulnerability in one product. The Top 25 is derived by mapping recent CVEs to their root-cause CWEs, which is why it is often described as data-driven. The list was co-branded with SANS in earlier years, so you may still see it called the SANS/CWE Top 25. In short: OWASP Top 10 is an awareness list of web application risk categories, while the CWE Top 25 is a ranked list of specific weaknesses across all software, from web apps to kernels and firmware.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
The ranking, CWE identifiers, and weakness names on this page are from the 2025 CWE Top 25 Most Dangerous Software Weaknesses published by The MITRE Corporation and used under the CWE Terms of Use. Copyright © 2006-2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE is free to use by any organization or individual for any research, development, and/or commercial purposes, per the CWE Terms of Use. All explanations, examples, and mitigation guidance are original material written by CyberCertPrep and are not MITRE text. CyberCertPrep is not affiliated with or endorsed by MITRE. Always check the official CWE site for the authoritative current edition.