Table of Contents on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

2017 Top 10 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

Previous versions are available at OWASP Top Ten 2021 and OWASP Top 10 2017 (PDF).

Join the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.

Redirecting to OWASP Top 10:2025...

<p>This major update adds several new issues, including two issues selected by the community - A8:2017-Insecure Deserialization and A10:2017-Insufficient Logging and Monitoring. Two key differentiators from previous OWASP Top 10 releases are the substantial community feedback and extensive data assembled from dozens of organizations, possibly the largest amount of data ever assembled in the preparation of an application security standard.

A6:2017-Security Misconfiguration on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

February 21, 2023 - Loading · ×Sorry to interrupt · Refresh

July 8, 2022 - This paper discusses the practices and strategies used by the HDR application to mitigate risks posed by the security vulnerabilities documented in the OWASP Top 10 – 2017.

February 25, 2022 - But A10:2021-Server-Side Request Forgery (SSRF) shows that they are not bulletproof, and they need more configuration (A05:2021-Security Misconfiguration). If we look at the top positions, in 2017 Injection and Broken Authentication were the ...

A5:2017-Broken Access Control on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

May 29, 2023 - OWASP Top 10 2017 brings three new vulnerabilities and retires two. Despite these changes, many vulnerabilities from 2013 remain on the list, making OWASP Top 10 2017 very similar to its predecessor.

May 30, 2017 - The OWASP Top 10 2017 release offers improvements, but also introduces new issues. Read more to get CoE lead, Andrew McKenna's thoughts and recommendations.

2017-A10 - Underprotected APIs · Testing your APIs for vulnerabilities should be similar to testing the rest of your web application. Different types of injection, authentication, access control, encryption, configuration, and other issues can exist in APIs just as in a traditional web application. Two items were removed from the OWASP Top 10 2017 ·

October 2, 2024 - Some vulnerabilities from the 2017 list, such as XML External Entities (XXE) and Insecure Deserialization, were removed in 2021, suggesting a decrease in their prevalence or a shift in focus towards more pressing security concerns. The 2021 list emphasizes the importance of Security Logging and Monitoring Failures, underscoring the need for robust logging practices to detect and respond to security incidents effectively. The evolution from OWASP Top 10–2017 to OWASP Top 10–2021 reflects the changing landscape of web application security.

December 26, 2017 - Two old categories that made OWASP's Top 10 in 2013, Insecure Direct Object References and Missing Function Level Access Control, merged together into a single category "Broken Access Control" for its 2017 list.

OWASP Top 10 is the standard guide for developers and online application security. It provides a consensus of the most important security threats to web applications.

Release Notes on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

September 13, 2023 - Now, let’s delve into the details of the second item in the OWASP Top 10: Broken Authentication.

January 28, 2026 - OWASP Top 10 lists are created for various categories, though the most commonly used OWASP Top 10 list is the one for Web Application Security. The current Top 10 list as of 2017 include the following website vulnerabilities: