I ran FindBugs analysis on drools-core module on master. There is 880 warnings in the report. So a pretty decent number. I picked some for start. See attachments. Also we should focus on concurrency warnings. You can find them in the report under "Multithreaded correctness Warnings" section.

For better description of the warnings, you can install FindBugs-IDEA plugin and run the analysis in IDE. Each warning has some short description, sometimes with a link pointing to an article or more detailed info about the problem.