This is highly opinionated and controversial, but I wanted to provide food-for-thought for you to make your own decision.
There's OWASP, CWE, and WASC. I don't like any of them.
Why shouldn't I use any of these categorization methods?
OWASP Top 10 attempts to provide a most common list at a high-level view of what has happened in the last two years. But when you are creating technical reports, attempting to map vulnerabilities to these high-level categories leaves a lot open for interpretation and a lot of room is left for things that don't fit.
Take these examples:
"Mercurial remote code execution in Importer" - Missing Function-level Access Control? According to OWASP, that's not appropriate. https://bounty.github.com/classifications/missing-function-level-access-control.html even says it is for controlling access to sensitive data, not for preventing arbitrary code from running.
But there's more.
"Git LFS code execution" is put under "Other." "GitHub for Windows remote code execution" is under Injection.
What do these three have in common? They are code injection. But under these OWASP mappings, they are three different things. Does that make sense to a manager that has to review your report? Call it what it is - Remote Code Execution. How it came about, how to fix it, those are separate things from what the problem is, the problem is executing arbitrary code or commands.
Why should I use these categorization methods?
Mapping to some parent categorization can make reporting easier when providing how often the organization encounters XSS or other problems.
Final word of caution
The industry has some problems to fix, and I think this is a big one. 10 categories is not enough for mapping. 25 categories is getting better, but your organization may be more targeted for mobile applications with web API endpoints, for which categorizing as "Injection" doesn't work as well as categorizing as LDAP injection, or something else.
The choice is of course yours, but over the years, this is what I've learned.