Looking for a Shorter Overview?
AI Summary
Key Moments
Most common security flaws
Seven main types account for 90% of the flaws, with accidental information leakage and trademark counterfeiting at the top.Risks of security flaws
An average of 20 flaws per app gives attackers many opportunities to exploit weaknesses and gain unauthorized access.The importance of proactive work
Companies must work in multiple layers and continuously identify and address security risks.Recommended actions
Regular vulnerability scanning, rapid updates, minimized data exposure, and monitoring improve security.New research from Barracuda shows that the average web application has 20 security vulnerabilities that attackers can exploit to steal data, hijack accounts or gain unauthorized access to systems. The study also shows that the most common vulnerabilities are often due to security settings and oversights that could have been avoided.
Barracuda security researchers have analyzed hundreds of scans conducted with Barracuda Application Security Insight over five months in 2026. The analysis identified seven main types of security vulnerabilities that together account for around 90 percent of all vulnerabilities discovered.
The most common are:
- Accidental disclosure of system information – 25 percent. It is about an application revealing too much information about, for example, systems, domains, hidden pages, search paths or services. Attackers can use the information to map the environment, identify weak points, find hidden functions and administration pages and plan more targeted attacks – without being detected themselves.
- Brand and identity fraud – 23 percent. Flaws that make it easier for attackers to impersonate a trusted brand, website, or domain and trick users into giving up login credentials or sensitive information. Attackers can clone websites, redirect users to malicious websites, steal login credentials, or send credible phishing emails in the brand’s name, among other things.
- Attacks via the user's browser – 14 percent. Vulnerabilities in how web pages display or execute content can allow attackers to execute malicious code in a user's browser. For example, Cross-Site Scripting (XSS) can be used to steal session cookies, modify visible content, trick users into clicking hidden buttons, or upload deceptive files.
- Exposure of sensitive data – 10 percent. Sensitive information is unnecessarily exposed through web pages, APIs, logs, cookies, tracking scripts, or misconfigured responses. Attackers can exploit this to collect personal data, access tokens, private content, secrets, or confidential company information, such as email and configuration data. The flaws can also allow users to be tracked without their consent or to manipulate access and data retention policies.
Other flaws identified include weak or missing encryption that could allow attackers to intercept or manipulate traffic (6 percent), outdated software or insecure configurations (6 percent), and shortcomings in the management of user sessions and the protection of cookies and login credentials (5 percent). 
– Web applications are a central interface for businesses, from digital stores to interactive services for customers, partners and your own business. Therefore, securing them is crucial. An average of 20 security vulnerabilities per application gives attackers multiple opportunities to search for, test and exploit weaknesses, says Jesus Cordero-Guzman, Director, Solution Architects AppSec, NetSec & XDR International at Barracuda.
“While each flaw may not be critical on its own, attackers can combine multiple low- or medium-risk flaws to access sensitive information, steal credentials, or gain unauthorized access. Therefore, companies need to work proactively and in multiple layers with application security so that risks are continuously identified and addressed,” he continues.
Five measures to reduce risks
Barracuda recommends that:
- regularly scan for vulnerabilities and incorrect security settings
- quickly install security updates for applications, frameworks, and dependencies
- minimize the amount of system information and sensitive data exposed
- strengthen encryption, authentication, and security around user sessions
- Continuously monitor web applications to detect suspicious activity and new threats.
Swedish 
Danish 
Norwegian 
Finnish 
English 
German 
Dutch 