Top 10 Code Vulnerabilities to Hunt For in 2026

Most breaches still start with a handful of well-known bug classes. The frameworks got safer, but the mistakes moved: into API handlers, background jobs, infrastructure code and the glue between services. This is the list we check first on every audit, with the CWE you will see in a CodeAuditAgent report.

1. Broken access control (CWE-639, CWE-862)

The most common serious finding by far: an endpoint loads a record by ID without checking that it belongs to the caller. Authentication tells you who someone is; authorization has to happen on every single query.

// Scope every lookup to the owner
const invoice = await db.invoice.findFirst({
  where: { id, userId: session.user.id },
});

2. Injection (CWE-89, CWE-78)

String-built SQL, shell commands and template expressions are still everywhere, usually in the one query someone wrote by hand for performance. Parameterize the query or pass arguments as an array; never concatenate input.

3. Hardcoded secrets (CWE-798)

API keys committed to the repository, test tokens that turned out to be live, private keys in config files. Move them to environment variables or a secret manager, and rotate anything that was ever committed: deleting the line does not delete the history.

4. Server-side request forgery (CWE-918)

Any feature that fetches a user-supplied URL, such as webhooks, link previews or imports, can be pointed at your internal network or cloud metadata endpoint. Allowlist hosts, resolve and check the IP, and block private ranges.

5. Cross-site scripting (CWE-79)

Modern frameworks escape by default, so XSS now hides in the escape hatches: raw HTML props, markdown renderers, and URLs placed in href attributes. Sanitize HTML with a vetted library and reject javascript: URLs.

6. Insecure deserialization and eval (CWE-502, CWE-95)

Pickle, YAML load, Java object streams and dynamic eval turn data into code. Use safe loaders and schema-validated JSON instead.

7. Weak cryptography (CWE-327, CWE-330)

MD5 or SHA-1 for passwords, static IVs, Math.random() for tokens. Use a password hash designed for the job (Argon2id, bcrypt, scrypt) and a cryptographically secure random source.

8. Open redirects (CWE-601)

A next or returnTo parameter that accepts any URL makes your domain a trusted launchpad for phishing. Accept only same-origin relative paths.

9. Missing rate limiting (CWE-307, CWE-770)

Login, password reset, OTP and any endpoint that costs you money (email, SMS, AI calls) need limits per user and per IP. Without them, brute force and bill-shock attacks are trivial.

10. Security misconfiguration (CWE-16)

Wildcard CORS with credentials, debug mode in production, verbose stack traces, permissive bucket policies. These rarely look like bugs in code review because they live in config, which is exactly why they should be reviewed like code.

How to use this list

• Check classes 1 to 3 on every pull request; they are the highest-impact and the easiest to miss.
• Treat infrastructure and CI config as code under review.
• Record the CWE on every finding so fixes can be tracked and trends measured.