The OWASP Top Ten is a good start and gets better each year. https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...