CISA: Most exploited vulnerabilities should have been eradicated decades ago

CISA's review of 2024–2025 finds that decades-old, well-known vulnerability classes—such as improper input validation (CWE-20), XSS, SQL and OS command injection, and path traversal—remain among the most exploited and frequent entries in CVE and Known Exploited Vulnerability (KEV) catalogs; the agency attributes this persistence to failures in Secure by Design adoption, organizational culture, and developer workflows and urges vendors and buyers to prioritize secure development, SBOMs, and automation of security controls.