OWASP Web Security Top 10
2025The OWASP Top 10 (2025) is the standard awareness document for developers and web application security — a broad consensus on the most critical risks to web applications. Two structural changes land in this edition: Software Supply Chain Failures widens the old Vulnerable and Outdated Components category, and Mishandling of Exceptional Conditions is new at #10. SSRF is no longer its own entry; it now sits inside A01 Broken Access Control.
A01:2025Broken Access ControlCriticalA02:2025Security MisconfigurationHighA03:2025Software Supply Chain FailuresHighA04:2025Cryptographic FailuresHighA05:2025InjectionHighA06:2025Insecure DesignHighA07:2025Authentication FailuresHighA08:2025Software or Data Integrity FailuresHighA09:2025Security Logging and Alerting FailuresMediumA10:2025Mishandling of Exceptional ConditionsMedium