Top Ten Web App Sec Problems

One of the things we are going to be doing on the OWASP portal when it comes online in January is to keep track of vulnerabilities and build a "top ten in the wild".

Does anyone know if there have been any good statistical studies on webappsec vulns (we know about the SANS top 20, but this is webappsec specific) ?

Does anyone want to share their thoughts and top ten ?

-- 
Mark Curphey