2024's Most Critical Software Vulnerabilities
The MITRE Corporation has once again released its annual list of the top 25 most dangerous software weaknesses. This year's list, developed in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), highlights the most severe and prevalent vulnerabilities that could be exploited by malicious actors.
Understanding the Threat Landscape
The 2024 CWE Top 25 list is a critical resource for developers, security professionals, and organisations worldwide. By identifying the most common and dangerous software weaknesses, this list enables organisations to prioritise their security efforts and allocate resources effectively.
Key Vulnerabilities to Watch Out For:
- Cross-site Scripting (XSS) (CWE-79): This persistent threat allows attackers to inject malicious scripts into web pages, stealing sensitive information or compromising user sessions.
- Out-of-Bounds Write (CWE-787): This vulnerability can lead to memory corruption, crashes, and potential remote code execution.
- SQL Injection (SQLi) (CWE-89): Attackers can exploit SQLi to manipulate database queries, steal data, or even take control of the database server.
- Cross-Site Request Forgery (CSRF) (CWE-352): This attack tricks users into performing unauthorised actions on behalf of their authenticated sessions.
- Path Traversal (CWE-22): Attackers can exploit this vulnerability to access files outside the intended directory, potentially leading to data exposure or system compromise.
TOP 25 MOST DANGEROUS SOFTWARE WEAKNESSES OF 2024
| RANK | WEAKNESS NAME | CWE ID | SCORE | CVES IN KEV | CHANGE |
| 1 | Cross-site Scripting | CWE-79 | 56.92 | 3 | +1 |
| 2 | Out-of-bounds Write | CWE-787 | 45.20 | 18 | -1 |
| 3 | SQL Injection | CWE-89 | 35.88 | 4 | 0 |
| 4 | Cross-Site Request Forgery (CSRF) | CWE-352 | 19.57 | 0 | +5 |
| 5 | Path Traversal | CWE-22 | 12.74 | 4 | +3 |
| 6 | Out-of-bounds Read | CWE-125 | 11.42 | 3 | +1 |
| 7 | OS Command Injection | CWE-78 | 11.30 | 5 | -2 |
| 8 | Use After Free | CWE-416 | 10.19 | 5 | -4 |
| 9 | Missing Authorisation | CWE-862 | 10.11 | 0 | +2 |
| 10 | Unrestricted Upload of File with Dangerous Type | CWE-434 | 10.03 | 0 | 0 |
| 11 | Code Injection | CWE-94 | 7.13 | 7 | +12 |
| 12 | Improper Input Validation | CWE-20 | 6.78 | 1 | -6 |
| 13 | Command Injection | CWE-77 | 6.74 | 4 | +3 |
| 14 | Improper Authentication | CWE-287 | 5.94 | 4 | -1 |
| 15 | Improper Privilege Management | CWE-269 | 5.22 | 0 | +7 |
| 16 | Deserialization of Untrusted Data | CWE-502 | 5.07 | 5 | -1 |
| 17 | Exposure of Sensitive Information to an Unauthorised Actor | CWE-200 | 5.07 | 0 | +13 |
| 18 | Incorrect Authorisation | CWE-863 | 4.05 | 2 | +6 |
| 19 | Server-Side Request Forgery (SSRF) | CWE-918 | 4.05 | 2 | 0 |
| 20 | Improper Restriction of Operations within the Bounds of a Memory Buffer | CWE-119 | 3.69 | 2 | -3 |
| 21 | NULL Pointer Dereference | CWE-476 | 3.58 | 0 | -9 |
| 22 | Use of Hard-coded Credentials | CWE-798 | 3.46 | 2 | -4 |
| 23 | Integer Overflow or Wraparound | CWE-190 | 3.37 | 3 | -9 |
| 24 | Uncontrolled Resource Consumption | CWE-400 | 3.23 | 0 | +13 |
| 25 | Missing Authentication for Critical Function | CWE-306 | 2.73 | 5 | -5 |
Cyber News Wrap-Up January: Key Cyber Security Stories
CYBER NEWS WRAP-UP: JANUARY 2026 Welcome everyone to the first cyber recap of the year! As we kick off 2026, it’s time to bring you a concise overview of the […]
Security Platform Updates: SendSafely HALO and Agile Blue Enhancements
SOLUTION UPDATES & NEW FEATURES At CommuniCloud, we actively monitor updates across our security solutions to ensure our customers are aware of new capabilities that may improve their security posture, […]
February 2026 Cyber Threats Australia: MITRE ATT&CK + Essential Eight
MITRE ATT&CK & ESSENTIAL EIGHT ALIGNMENT Aligning MITRE ATT&CK with the Essential Eight helps organisations move from generic security activity to targeted risk reduction. MITRE ATT&CK shows how attackers gain […]
IRONSCALES Email Security: Adaptive AI, Human Intelligence, Real Defence
Spotlight Feature | Ironscales: Modern Email Security Built For How Attacks Actually Happen Email remains the primary entry point for cyber attacks. Business email compromise, credential harvesting, impersonation, and socially […]