MITRE shares 2025's top 25 most dangerous software weaknesses

MITRE, in cooperation with HSSEDI and CISA, published the 2025 CWE Top 25—a ranked list of the most dangerous software weaknesses derived from 39,080 CVEs (June 2024–June 2025). The report details rankings and score changes (noting new entries like classic/stack/heap buffer overflows and improper access control), emphasizes real-world exploitation risks (including OS command injection used by Velvet Ant), and urges developers and security teams to adopt Secure by Design practices and integrate the list into testing and vulnerability management.