Mitre has published the top 25 programming mistakes that lead to security breaches.

Cross-site scripting is number one, with SQL Injection and buffer overflow following.