January 20, 2026 - The Open Web Application Security Project (OWASP) has officially released the eighth edition of its influential Top 10 security risks list for 2026, introducing significant changes that reflect the evolving landscape of application security threats.

Globally recognized by developers as the first step towards more secure coding. Companies should adopt this document and start the process of ensuring that their web applications minimize these risks. Using the OWASP Top 10 is perhaps the most effective first step towards changing the software development culture within your organization into one that produces more secure code.

The 2026 Top 10 is anchored in 2025 smart contract incident data and practitioner input, as detailed on the dedicated Data Sources page.

June 11, 2026 - OWASP ranks Broken Access Control as the highest risk because authorization mistakes often expose sensitive data and critical business functions. Enforce server-side authorization checks.

February 23, 2026 - The Open Web Application Security ... 2026, a forward-looking standard awareness document designed to arm Web3 developers, security auditors, and protocol owners with actionable intelligence on the most critical vulnerabilities affecting smart contracts today...

3 weeks ago - Two new categories, SSRF absorbed, security misconfiguration now at #2. The new OWASP ranking explained, with the 2026 supply-chain data that matters.

February 3, 2026 - The OWASP Top 10 is a globally recognized list of the ten most critical web application security risks. It guides developers and organizations to focus on the most common and impactful threats and is often referenced in security standards and ...

June 4, 2026 - There is no official "OWASP Top 10 2026" — the current, most recent edition is the OWASP Top 10:2025, released in late 2025, and it is what most "OWASP Top 10 2026" searches are actually looking for.

April 29, 2026 - The OWASP Top 10 came out for the first time in 2003. The newest version, OWASP Top 10:2025 (which is what we are running with right now in 2026), was built from analysis of more than 175,000 CVE records and input from the global security community.

January 6, 2026 - The Open Web Application Security Project (OWASP) has officially unveiled the eighth edition of its influential Top 10 security risks list for 2026, introducing significant changes that reflect the evolving landscape of application security threats.

June 3, 2026 - The old security playbooks are obsolete. The Open Web Application Security Project (OWASP) has responded. The “OWASP Top 10 for Agentic Applications 2026” is the new benchmark for security in this autonomous age.

December 10, 2025 - The OWASP Top 10 for Agentic Applications 2026 is a globally peer-reviewed framework that identifies the most critical security risks facing autonomous and agentic AI systems. Developed through extensive collaboration with more than 100 industry ...

June 5, 2026 - OWASP Top 10 for LLMs 2025OWASP Top 10 for Agents 2026NIST AI RMFMITRE ATLASEU AI ActBeaverTailsAegis ... The OWASP Top 10 for Agentic Applications (ASI) identifies the most critical security risks introduced by autonomous and semi-autonomous ...

April 6, 2026 - You push to prod, close your laptop, and go enjoy your weekend. Saturday morning, 6:47 AM — your phone buzzes. Then again. Then your manager calls. Your app was breached overnight, customer data is out in the wild, and the attack vector? A vulnerability that’s been on the OWASP list for the better part of a decade.

April 25, 2026 - The 2026 edition refines the categories introduced in previous versions while highlighting the growing impact of cloud-native architectures and AI-powered attack techniques on the threat landscape.

Insecure Design includes a range of weaknesses that can be emdedded in the architecture of an application. It focuses on the design of an application, not its implementation. OWASP lists the use of security questions (e.g. "What street did you grow up on?") for password recovery as one example of a workflow that is insecure by design.

December 10, 2025 - The OWASP tracker includes confirmed cases of agent mediated data exfiltration, RCE, memory poisoning, and supply chain compromise. Aikido’s research team has seen similar patterns emerge in CI/CD and supply chain investigations.

May 13, 2026 - Architectural mistakes — missing rate limits on OTPs, no anti-automation on signups, insecure default trust between services. Defense: threat modeling at design phase, abuse cases for every feature, security stories in every sprint.

The OWASP Smart Contract Top 10 : 2026 is a standard awareness document that aims to provide Web3 developers and security teams with insights into the top 10 vulnerabilities found in smart contracts.

February 20, 2026 - Risks range from Agent Goal Hijack (ASI01) and Tool Misuse (ASI02) to Identity & Privilege Abuse (ASI03) and Insecure Inter-Agent Communication (ASI07). It’s 2026 and if you haven’t at least heard about AI agents then you’re living in ...