The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.

Redirecting to OWASP Top 10:2025...

In this edition of the Top Ten 2025, there are 248 CWEs within the 10 categories. There are a total of 968 CWEs in the downloadable dictionary from MITRE at the time of this release. Similar to what we did for the 2021 edition, we leveraged CVE data for Exploitability and (Technical) Impact. We downloaded OWASP ...

Official OWASP Top 10 Document Repository. Contribute to OWASP/Top10 development by creating an account on GitHub.

October 2, 2025 - The OWASP Top 10 provides rankings of—and remediation guidance for—the top 10 most critical web application security risks. Leveraging the extensive knowledge and experience of the OWASP’s open community contributors, the report is based ...

The OWASP Top 10 is a standard awareness document for developers and web application security.

The OWASP Top 10 is a regularly updated report outlining security concerns for web application security, focusing on the 10 most critical risks. The report is put together by a team of security experts from all over the world.

The OWASP Top 10 for Large Language Model Applications continues to be a core component of our work, identifying the most critical security vulnerabilities in LLM applications.

Based on the analysis, prioritization, and validation, we create the final OWASP Top 10 list. The list includes the most impactful and prevalent mobile application security vulnerabilities, along with information on how to detect and mitigate them.

December 20, 2023 - OWASP Top 10 is a list of security vulnerabilities that pose the most risk to web applications.

January 28, 2026 - The current Top 10 list as of 2017 include the following website vulnerabilities: A1. Injection · A2. Broken Authentication · A3. Sensitive Data Exposure · A4. XML External Entities (XXE) A5. Broken Access Control · A6. Security Misconfiguration · A7. Cross-Site Scripting (XSS) A8. Insecure Deserialization · A9. Using Components with Known Vulnerabilities · A10. Insufficient Logging and Monitoring · It is important to understand that the OWASP Top 10 is not an exhaustive list of all current vulnerabilities.

April 10, 2026 - SQL Injections are at the head of the OWASP Top 10, and occur when a database or other areas of the web app where inputs aren’t properly sanitized, allowing malicious or untrusted data into the system to cause harm. SQL injection attacks are simply when data is sent to any form of code interpreter that can be run as a command or in the case of a database – a query.

Historically, OWASP primarily focused on risks in web apps. Tellingly, however, OWASP officially released an updated top 10 just this year — this time for LLMs, or more precisely: applications using large language models (LLMs).

But I was also thinking that, as the OWASP Top 10 basically lists the most critical risks in Web Application, and ZAP is running against WA, then it might be reasonable to suggest that the OWASP Top 10 vulnerabilties are covered as extensively as possible.

“Broken Access Control” is the number one issue in the 2021 OWASP Top 10 – it's super specific to your application with subtleties and edge cases.

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

Presented below are the top 10 CI/CD security risks.

We asked ourselves whether we wanted to go with a single CWE for each "category" in the OWASP Top 10. Based on the contributed data, this is what it could have looked something like: 1. Reachable Assertion 2. Divide by Zero 3. Insufficient Transport Layer Encryption 4.

January 13, 2026 - OWASP stands for Open Worldwide Application Security Project. This non-profit foundation works to improve software security. They have published a Top 10 list for 2025 that acts as an awareness document for developers.

December 18, 2025 - Explore the OWASP Top 10 vulnerabilities, a critical list of the most common web application security risks for developers and security teams.