Top 10 Explorer
Browse all OWASP Top 10 lists covering web (2021 & 2025), API, mobile, GenAI/LLM, CI/CD, and cloud-native security risks.
Top 10 Web Application
Broken Access Control
Access control enforces policy such that users cannot act outside their intended permissions. Still the #1 risk moving to more granular, data-centric enforcement is now the standard expectation.
Security Misconfiguration
Insecure default configurations, misconfigured cloud storage, verbose error messages, and enabled unnecessary features. Moved up from #5 in 2021 as cloud and IaC sprawl has made misconfiguration the leading attack surface.
Software Supply Chain Failures
NEW in 2025. Vulnerabilities introduced through third-party libraries, open-source dependencies, build tooling, or compromised update mechanisms. Covers SCA, SBOM, and dependency confusion attacks.
Cryptographic Failures
Failures related to cryptography that expose sensitive data: weak algorithms, improper key management, missing TLS, and storing data in cleartext. Formerly 'Sensitive Data Exposure' refocused on the cryptographic root cause.
Injection
Untrusted data sent to an interpreter as part of a command or query. SQL, NoSQL, OS, LDAP, and expression language injection can result in data exfiltration, corruption, or full server takeover.
Insecure Design
Missing or ineffective control design a broad category requiring threat modeling, secure design patterns, and reference architectures during development, not just testing at the end.
Authentication Failures
Flaws in authentication and session management that allow attackers to assume other users' identities. Covers credential stuffing, weak passwords, missing MFA, and session fixation. Renamed from 'Identification and Authentication Failures'.
Software or Data Integrity Failures
Code and infrastructure that does not protect against integrity violations insecure deserialization, auto-update without signature verification, and CI/CD pipeline poisoning.
Security Logging and Alerting Failures
Insufficient logging, monitoring, and alerting allows breaches to go undetected. Renamed 'Alerting' to emphasize the need for active notification pipelines, not just passive log collection.
Mishandling of Exceptional Conditions
NEW in 2025. Applications that crash, expose stack traces, enter undefined states, or silently swallow errors give attackers insight into internals or allow them to bypass security controls through error-path manipulation.