Unforgivable Vulnerabilities

In 2007, MITRE published "Unforgivable Vulnerabilities," listing 13 recurring classes of coding error (known as the "Lucky 13") for which effective mitigations had been available.

These are defects (like XSS, SQLi) that keep appearing year after year. Their recurrence is not a technical mystery; it is a business and incentive failure.

The presence of an unforgivable vulnerability signals that customer safety was not treated as a non-negotiable requirement.

Compare the Lucky 13 to MITRE's Top 25 Most Dangerous Software Weaknesses.

Discussion prompts

• Which unforgivable vulnerability classes have appeared in your products in the past two years?
• What would it take to make one unforgivable class structurally impossible in your codebase?
• How do you communicate to leadership when a preventable defect class keeps recurring?