As a bug bounty triager and researcher, the most common type of bug I see is Insecure Direct Object Reference (IDOR). In their simplest form, IDOR bugs occur when a user provides an ID to the server that they do not normally have access to, and the server accepts it without validation.