In my opinion, knowing specific software vulnerabilities is not as much helpful for improving the security of your organization as performing a full IT risk assessment. After the risk assessment you will be able to evaluate, in a more objective way, if the main problem for your IT infrastructure are the software vulnerabilities, the phisical security, the people, the procedures or other elements.
There exist multiple methodologies and frameworks to perform risk assessments Magerit, OCTAVE, Mehari and others.
Here, in Spain, Magerit is very used because it is supposed that public administrations must use it in order to identify and be able to reduce the risks for the organization. Magerit includes a catalogue of threats that can be used as a "comprehensive guide of general/common IT vulnerabilities" as you ask in your question.