The mix is shifting toward the web. The classes haven't changed.
If AI were inventing new kinds of vulnerabilities, you'd expect the weakness taxonomy to churn. It hasn't. What's moved is the ranking — authorization and web-injection flaws rising, the single dominant memory-safety weakness sliding.
CWE Top 25 — how the ranks moved, 2023→2025
Selected weaknesses in MITRE's ranking. Highlighted lines are the notable movers.
Memory safety is a tale of two codebases
Where memory-safe languages arrived
Memory-safety bugs fell from 76% of Android's vulnerabilities (2019) to 24% (2024), which Google attributes to writing new code in memory-safe languages rather than rewriting old code. That is a share of Android's bugs, not a density.
Google Security Blog, Sep 2024Where they didn't
Microsoft and Chromium have each reported that roughly 70% of their serious bugs are memory-safety issues, each measured on its own population. Those are two publishers, not the whole C/C++ world; they show the problem persisting where the code is old, not a measured trend everywhere.
CISA / Google, memory-safety roadmapsDo AI tools find different bugs? They split by paradigm.
AI-found bugs split by tool paradigm. LLM web/app pentesters (XBOW) skew to the injection/web surface — RCE, SQLi, XXE, SSRF, XSS. Code-reasoning / variant-analysis tools (Big Sleep) reach memory-safety bugs fuzzing missed — the SQLite stack overflow, 12 OpenSSL vulns. Autonomous end-to-end systems (AIxCC) span both C and Java, memory-safety and injection. Cross-cutting: both paradigms only produced reliable results once a deterministic NON-LLM verifier was bolted on — unsupervised LLM 'finds' over-report plausible-but-false web-class issues.
The honest caveat on this whole section
No single public dataset shows "share of all vulnerabilities by class over time." The CWE Top 25 ranks CVE-prevalence × severity, which over-weights the high-volume web ecosystem. And 2025's new buffer-overflow entries are partly a MITRE taxonomy re-split, not a real memory-bug resurgence. The type mix is stable as far as the data shows — but the data is coarser than the confident takes assume.