I would risk, that this question couldn't be answered. The topic is too broad, and unspecified.
A "security flaw" is first of all domain and application specific. A "security flaw" in one application may be considered a "feature" in another in a totally unrelated domain (e.g., unauthenticated shutdown of a system is bad online on the stock exchange, good on an oil rig if the pump is out of control).
Then we don't really know how to classify bugs in the place :)
A good solution could be a risk evaluation based on risk assessments which in turn is based on your specification. For this, you would need specialists ("the cybersecurity guys") involved in the project itself. It would be advisable to involve them from the offering/early planning stage, so they can identify potential pitfalls all the way as you go with development. Sadly, nowadays security is always added during the later/latest steps and it almost always involves unnecessary overhead because of this.
The bad thing about security is: good security is invisible, thus hard to market/sell; missing security on the other hand is most probably devastatingly bad.
And I close with an anecdote from undisclosed sources (allegedly originates from Amazon): the head of the IT Security department says at the yearly evaluation meeting: "We didn't have any incidents last year, thus we would like to double our budget for the next year."