CISA is again pressing software vendors to adopt Secure by Design practices after a new review found that some of the most exploited vulnerability classes remain old, familiar and preventable, according to The Register. The agency examined vulnerabilities across 2024 and 2025 and found that many bugs assigned Common Vulnerabilities and Exposures identifiers and added to CISA’s Known Exploited Vulnerabilities catalog trace back to weakness classes that have been documented for years. The Register reports that CISA framed the persistence of those flaws as a failure of organizational practice, not merely a technical problem. The recurring categories include injection-related vulnerabilities such as cross-site scripting, tracked as CWE-79; operating-system command injection, CWE-78; and SQL injection, CWE-89. The Register says CISA found those classes among the most common across both CVE and KEV records in 2024 and 2025. Improper input validation, CWE-20, stood out more broadly. According to The Register’s account of the review, CISA identified it as the single most common weakness type across registered CVEs and the KEV catalog. That matters because input validation is one of the basic defensive layers vendors use to prevent untrusted data from becoming an exploit path. CISA also tied the current data to older MITRE work on vulnerability classes that should no longer be common in production software. The Register reports that CISA compared recent findings with MITRE’s 2007 discussion of “unforgivable vulnerabilities” and a 2023 report on “stubborn weaknesses.” In CISA’s 2024 data, seven of the 10 most frequent CWEs on the CVE list were among MITRE’s stubborn weaknesses. The same was true for seven of the 10 most frequent CWEs in the KEV catalog, which together made up 41.5% of bugs on that list. The exploitation signal was not limited to prevalence in vulnerability databases. The Register says CISA found that three of the top five KEV weaknesses came from unresolved classes: improper input validation, path traversal and OS command injection. CISA described that pattern as evidence that these weakness classes continue to translate into real-world exploitation. The 2025 data followed a similar line, according to The Register. CISA said seven of the top 10 CWEs were still categories that MITRE would have considered “unforgivable” in 2007. It also said three of today’s top 10 CWEs would have fit that label nearly two decades ago, a term used for vulnerabilities arising from well-known mistakes with obvious attack paths and relatively simple exploitability. CISA’s Risk and Vulnerability Assessments, which The Register describes as no-cost penetration tests the agency performs for real organizations, pointed in the same direction. The review found memory safety and improper input validation vulnerabilities were reliable routes to exploitation, accounting for 16.7% of KEV entries in 2025, according to the report. The core message is not that the industry lacks knowledge of these bug classes. It is that known defensive practices are still failing to make their way consistently into vendor workflows. CISA’s Secure by Design push is aimed at shifting that burden earlier in the software lifecycle, before familiar weaknesses become deployed products and then emergency patches. Who benefits: Organizations that already emphasize Secure by Design practices, input validation, memory safety and systematic vulnerability prevention are better positioned under CISA’s framing. Security teams can also use the cited CWE categories as a practical prioritization lens. Who's exposed: Software vendors with weak secure-development workflows are exposed to continued exploitation of familiar bug classes. Customers relying on products with recurring input-validation, injection, path-traversal or memory-safety issues remain dependent on detection and patching after the fact.