Looking into the mentioned unforgivable vulnerabilities and stubborn weaknesses published by CISA:

Unforgivable Vulnerabilities (PDF)

Given the above criteria, following are some candidates for unforgivable vulnerabilities that satisfy all (or most) of the criteria for an unforgivable vulnerability. […]

1. Buffer overflow using long strings of "A" characters in:
   • a. Username/password during authentication
   • b. File or directory name
   • c. Arguments to most common features of the product or product class
2. XSS using well-formed <script> tags, especially in the:
   • a. Username/password of an authentication routine
   • b. Body, subject, title, or to/from of a message
3. SQL injection using ' in the:
   • a. Username/password of an authentication routine
   • b. "id" or other identifier field
   • c. Numeric field
4. Remote file inclusion from direct input such as:
   • a. include($_GET['dir'] . "/config.inc");
5. Directory traversal using "../.." or "/a/b/c" in GET or SEND commands of frequently-used file sharing functionality (e.g., a GET in a web/FTP server, or a send-file command in a chat client)
6. World-writable critical files:
   • a. Executables
   • b. Libraries
   • c. Configuration files
7. Direct requests of administrator scripts
8. Grow-your-own crypto
9. Authentication bypass using "authenticated=1" cookie/form field
10. TOCTOU race condition – symlink
11. Privilege escalation launching "help" (Windows)
12. Hard-coded or undocumented account/password
13. Unchecked length/width/height/size values passed to malloc()/calloc()

Stubborn Weaknesses