Some common vulnerabilities in APIs include broken authentication and access control, injection attacks, cross-site scripting (XSS), excessive data exposure, and security misconfiguration.