Bleepingcomputer

2025 CWE Top 25 Most Dangerous Software Weaknesses Released

First seen 11 Dec 2025, 20:50 UTC • Cisa

+5 •28.5

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The 2025 CWE Top 25 Most Dangerous Software Weaknesses list has been published, identifying critical vulnerabilities that pose significant risks to software security. This list is intended for developers and organizations to enhance their cybersecurity measures and protect sensitive information. The report emphasizes the importance of secure coding practices and awareness of these weaknesses.

How this analysis works

Attack Flow

20 entities, 19 inferred relationships (STIX 2.1).

Threat Actor (1)

Velvet Ant

Technique (3)

DDoS
Sql Injection
Cross-site Scripting

Organization (3)

Cisco
Ivanti
Palo Alto

Vulnerability (13)

CSRF
XSS
Allocation Of Resources Without Limits Or Throttling
Authorization Bypass Through User-Controlled Key
Buffer overflow
Classic Buffer Overflow
Heap-based Buffer Overflow
Improper Access Control
Missing Authentication
Missing Authorization
Null Pointer Dereference
OS Command Injection
Stack-based Buffer Overflow

Relationships

Velvet Ant uses DDoS
Velvet Ant uses Sql Injection
Velvet Ant uses Cross-site Scripting
Velvet Ant exploits CSRF
Velvet Ant exploits XSS
Velvet Ant exploits Allocation Of Resources Without Limits Or Throttling
Velvet Ant exploits Authorization Bypass Through User-Controlled Key
Velvet Ant exploits Buffer overflow
Velvet Ant targets Cisco
Velvet Ant targets Ivanti
Velvet Ant targets Palo Alto
Velvet Ant related to Classic Buffer Overflow
Velvet Ant related to Heap-based Buffer Overflow
Velvet Ant related to Improper Access Control
Velvet Ant related to Missing Authentication
Velvet Ant related to Missing Authorization
Velvet Ant related to Null Pointer Dereference
Velvet Ant related to OS Command Injection
Velvet Ant related to Stack-based Buffer Overflow

Continue Reading

Operation Highland: Velvet Ant's Decade-Long Espionage Campaign Exploitation of Remote Services in Cyber Attacks Payroll Pirate Campaign Targets Payroll Systems Using AiTM Session Hijacking

2025 CWE Top 25 Most Dangerous Software Weaknesses Released

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading