Usually it's specification mistakes - I spot cases I hadn't thought to cover, or the software not behaving as usefully as if I had made a different design decision.

Occasionally I'll catch things it didn't implement at all, or find things like missing permission checks.