1) Obvious vulnerability types in critical functionality, such as buffer overflows in
the username or password of a login feature
2) Incomplete fixes for the first vulnerabilities discovered in the product, often
involving a rushed patch for a single input or parameter, while other closely