Overview

The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications. First published in 2003, it has become the de facto starting point for application security worldwide and is referenced by standards, procurement requirements, and developer training programs across the industry.

The most current edition is OWASP Top 10:2025, whose final version was released in January 2026 after being announced at the OWASP Global AppSec conference in Washington, D.C. in November 2025. It supersedes the long-standing 2021 edition and introduces two brand-new risk categories alongside several re-rankings and renames.

The OWASP Top 10 is an awareness document, not a formal certifiable standard — it tells you where to focus, not exactly how to comply.

The Top 10:2025 Categories

Each category is identified by a stable code (A01:2025 through A10:2025) and groups together many related Common Weakness Enumeration (CWE) entries that share a common root cause.

  • A01:2025 – Broken Access Control — Users can act outside their intended permissions; now also absorbs Server-Side Request Forgery (SSRF).
  • A02:2025 – Security Misconfiguration — Insecure default settings, verbose errors, and improperly hardened systems; risen from #5 in 2021.
  • A03:2025 – Software Supply Chain Failures — NEW: compromises in building, distributing, or updating software, broadening the old vulnerable-components category.
  • A04:2025 – Cryptographic Failures — Missing, weak, or misused cryptography that exposes sensitive data and keys.
  • A05:2025 – Injection — Untrusted input alters commands or queries (SQL, OS, LDAP, and Cross-Site Scripting); fell from #3.
  • A06:2025 – Insecure Design — Missing or ineffective security controls baked into the architecture and design.
  • A07:2025 – Authentication Failures — Broken identity verification, session management, and credential handling; renamed from Identification and Authentication Failures.
  • A08:2025 – Software or Data Integrity Failures — Code and data trusted without integrity verification, including insecure deserialization and CI/CD pipelines.
  • A09:2025 – Security Logging & Alerting Failures — Insufficient logging, detection, and alerting that delays incident response.
  • A10:2025 – Mishandling of Exceptional Conditions — NEW: improper error handling, failing open, and logic errors arising from abnormal conditions.

How the List Is Built

The Top 10 is data-driven. For 2025, OWASP analyzed testing data from 13 contributing organizations covering more than 2.8 million applications, mapping roughly 220,000 CVEs onto 643 unique CWEs — a major expansion over the ~400 CWEs considered in 2021.

  • Eight of the ten categories are selected directly from the contributed vulnerability data, ranked by incidence and weighted with CVSS exploitability and impact scores.
  • Two slots are reserved for a community survey, capturing emerging risks that historical scan data cannot yet show — this is how forward-looking categories like Insecure Design enter the list.
  • Related CWEs are clustered by root cause rather than symptom, with categories capped at about 40 CWEs each to keep guidance actionable.
  • Contributors to the 2025 data set included vendors such as Veracode, Contrast Security, and Semgrep, supplying both human-assisted and tooling-derived results.

Because the data always looks backward, OWASP explicitly combines it with the survey so the list reflects both measured prevalence and the judgement of practitioners about where the field is heading.

How to Use It

  • Treat it as a prioritized awareness baseline, not a complete checklist — use the OWASP Application Security Verification Standard (ASVS) when you need testable requirements.
  • Map your threat modeling, code review, and pentest findings to the ten categories so risk is communicated in a shared vocabulary.
  • Drive secure-coding training and developer onboarding from the categories, pairing each with concrete prevention guidance and CWE references.
  • Use it in CI/CD gates and vendor assessments, but pair it with deeper standards rather than treating Top 10 'coverage' as proof of security.
  • Reference the per-category pages for prevention tips, example attack scenarios, and the mapped CWE list.

History & Evolution

Across two decades the Top 10 has evolved from an expert-curated list into a rigorous, partly data-driven methodology, refreshed roughly every three to four years rather than annually.

  • 2003 & 2004 — First editions, based largely on expert consensus about common web vulnerabilities.
  • 2007 — Refined to track the shifting web threat landscape, with greater emphasis on XSS and injection.
  • 2010 — Reframed explicitly around risk (likelihood and impact) rather than just raw vulnerability counts.
  • 2013 — Restructured categories and added components-with-known-vulnerabilities concerns.
  • 2017 — Strengthened the data-driven approach and introduced Insufficient Logging & Monitoring.
  • 2021 — Added Insecure Design and Software & Data Integrity Failures; built on data from 40+ organizations plus a community survey.
  • 2025 — Current edition: added Software Supply Chain Failures and Mishandling of Exceptional Conditions, merged SSRF into Broken Access Control, and analyzed 2.8M+ applications.

Resources