All undead NPCs have holy and silver. (Though like a PC there's nothing saying that in some cases they might not also have resistances/immunity stacked over that.)

Beyond that it's area writer discretion, and I mostly support that. For example, most of the undead in the Mausoleum have an extra vuln or two (which can be justified descriptionwise, etc. but that's another story), which I think balances nicely with it being probably the deadliest place you can go to get XP in the 20s.