Another resource I’d recommend is OWASP’s lists, their top 10 is a good starting place:

https://owasp.org/www-project-top-ten/