Rank 1 in the 2024 CWE Top 25 (frequency x severity of CVEs). Cross-site Scripting (XSS): the software does not neutralise user-controllable input before it is placed in output used as a web page, allowing attacker-supplied script to execute in victims' browsers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.