There is not a top 1000, because that wouldn't actually be relevant to most people. The OWASP top 10 are chosen because they are applicable across the vast majority of web applications, and are likely to be exploited if you do not secure them.
Beyond that, if you are starting from a position of already having applications and infrastructure:
- Understand your assets - have a list of all your applications, platforms and versions
This can be very challenging in a large organisation, but without it, how will you know what you are vulnerable to?
- Cross reference this list with the CVE database to understand the types and number of vulnerabilities which apply to your assets
The CVE database goes to the level of specific versions of applications and platforms so you can get a very tailored view of vulnerabilities you should be aware of. It also provides a rating (from 1 to 10) and a description of how the vulenrability can be exploited (eg local, remote etc)
- Identify your threat actors
This could be environmental activists, terrorists, competitors, foreign governments, bored students, organised crime gangs etc.
- Assess impact and likelihood based on the previous steps and prioritise remediation
You can never protect against all possible attacks, so this step is essential to help you decide where your limited budget and time will have the best return. If you can't articulate the value of a remediation project to the board you may find it difficult to get buy-in and budget.
A better position is to build a security governance framework which helps define and assure security in the development lifecycle, so this will help you build an architecture and testing plan to help reduce the likelihood of vulnerabilities getting into code in the first place - but this is a much longer discussion, and probably will see you utilising consultants :-)
tl;dr - OWASP Top 10 will give you the best initial view on what you need to do to protect yourself. After that check the CVE database for specific vulnerabilities for your code. Improving your procedures/framework/SDLC will protect you best in the long run. Proactive, rather than reactive.