What are common security issues in Cursor code?

The most frequent security issues in Cursor-generated code include SQL injection from string-concatenated queries, cross-site scripting from unsanitized user output, missing authentication middleware on API routes, and hardcoded secrets in source files. Other common problems are insecure direct object references (IDOR) where user authorization is not checked, overly permissive CORS settings, missing security headers, and use of deprecated cryptographic functions. These issues are not unique to Cursor but are amplified by the speed at which AI tools generate code. UNPWNED checks for all of these vulnerability categories in a single automated scan.