The OWASP has been around for a long time and they regularly publish a "Top 10" Web Application Security Risk list. It's amazing (or maybe not) how long some of these have been on the list:
1) Injection 2) Broken Authentication 3) Sensitive Data Exposure 4) XML External Entities (XXE) 5) Broken Access Control 6) Security Misconfigurations 7) Cross-Site Scripting (XSS) 8) Insecure Deserialization 9) Using Components with Known Vulnerabilities 10) Insufficient Logging & Monitoring