Looking into the mentioned unforgivable vulnerabilities and stubborn weaknesses published by CISA:

Unforgivable Vulnerabilities (PDF)

Given the above criteria, following are some candidates for unforgivable vulnerabilities that satisfy all (or most) of the criteria for an unforgivable vulnerability. […]

1. Buffer overflow using long strings of “A” characters in:
   • a. Username/password during authentication
   • b. File or directory name
   • c. Arguments to most common features of the product or product class
2. XSS using well-formed <script> tags, especially in the:
   • a. Username/password of an authentication routine
   • b. Body, subject, title, or to/from of a message
3. SQL injection using ’ in the:
   • a. Username/password of an authentication routine
   • b. “id” or other identifier field
   • c. Numeric field
4. Remote file inclusion from direct input such as:
   • a. include($_GET[‘dir’] . “/config.inc”);
5. Directory traversal using “…/…” or “/a/b/c” in GET or SEND commands of frequently-used file sharing functionality (e.g., a GET in a web/FTP server, or a send-file command in a chat client)
6. World-writable critical files:
   • a. Executables
   • b. Libraries
   • c. Configuration files
7. Direct requests of administrator scripts
8. Grow-your-own crypto
9. Authentication bypass using “authenticated=1” cookie/form field
10. TOCTOU race condition – symlink
11. Privilege escalation launching “help” (Windows)
12. Hard-coded or undocumented account/password
13. Unchecked length/width/height/size values passed to malloc()/calloc()

Stubborn Weaknesses

CWE-ID	Description	2023 Rank
CWE-787	Out-of-bounds Write	1
CWE-79	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	2
CWE-89	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	3
CWE-416	Use After Free	4
CWE-78	Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)	5
CWE-20	Improper Input Validation	6
CWE-125	Out-of-bounds Read	7
CWE-22	Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	8
CWE-352	Cross-Site Request Forgery (CSRF)	9
CWE-476	NULL Pointer Dereference	12
CWE-287	Improper Authentication	13
CWE-190	Integer Overflow or Wraparound	14
CWE-502	Deserialization of Untrusted Data	15
CWE-119	Improper Restriction of Operations within Bounds of a Memory Buffer	17
CWE-798	Use of Hard-coded Credentials	18