Record WatchRecord
Weakness shift: CWE-79 is now the #2 most common vulnerability type
25 August 2026 · Timeframe: Trailing 90 days vs the preceding 90
Over the last 90 days, CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) has moved into the #2 spot among all vulnerability types, displacing CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')). The top of this ranking rarely moves, which is what makes a shift worth noting.
Why it matters
The weakness mix is one of the most stable signals in vulnerability data. When it shifts, it says something real about where new code is failing and where to aim secure-development and testing effort.
What to do
- Security leaders. Check whether CWE-79 is covered by your testing and controls; a rising weakness type is a coverage question.
- Lean IT orgs. If you build software, add a improper neutralization of input during web page generation ('cross-site scripting') check to code review; it is rising for a reason.
- MSPs. Fold CWE-79 into client secure-development guidance and testing baselines.
Our take
Tracking the weakness mix, not just the CVE count, is how you see where risk is actually moving. A shift in a stable ranking is a leading indicator.