The ten failures that recur in every audit
The usual suspects
Broken access control — reaching another user's data by swapping an identifier.
Injection — input reaching a query, a system command or a template engine without separation.
Weak authentication — no attempt limits, no two-factor, with an exploitable password recovery.
Outdated components with known vulnerabilities.
Misconfiguration — defaults, exposed admin interfaces, open storage permissions.
Information exposure in error messages and logs.
File upload without a type check and without isolation.
No monitoring — a breach that lasts months because nobody looked.
What to do with the list
Go over it as a checklist on every significant release. Most organizations will find two or three items open, and closing them is worth more than any new tool that gets bought.
Going deeper
Check access control in automated tests: for every route, try to access with a different user and verify a refusal. It's the most common failure and also the easiest to cover automatically — yet almost nobody does it.