OWASP Top 10

OWASP Top 10 is a list of the ten most serious types of security risks for web applications. It is published by the OWASP Foundation (Open Worldwide Application Security Project). The list groups related weaknesses into ten categories and orders them by how often they occur and how damaging their consequences are. Each category is tied to CWE identifiers — a shared catalogue of software flaw types. For developers, pentesters and auditors it is a common reference point: where to start so that an application is secure. The most recent editions are OWASP Top 10:2021 and the newer OWASP Top 10:2025, but the 2021 edition is still the most widely cited.

What is OWASP?

OWASP is a non-profit organization that has been working on software security since 2001. It runs open, free projects — among them the Top 10 itself, the ASVS testing standard, the practical OWASP Cheat Sheet Series, and the OWASP ZAP scanner. They are built by an international community of researchers, developers and application-security specialists.

It helps to be clear about what the Top 10 is not. It is not a compliance standard you have to meet, nor a complete list of every possible vulnerability. It is an awareness document: it shows the most common and most damaging types of flaws. Treat it as the minimum starting point, not a full checklist of tests.

How is the OWASP Top 10 compiled?

The list is not assembled from memory. It is built from real-world testing data and a survey of specialists. In the 2021 edition it worked like this:

• Eight of the ten categories were chosen from contributed data, and two from a community survey. The survey is needed because it catches threats that automated scanners do not yet detect at scale.
• The data came from over 500,000 applications contributed by a dozen organizations. The analysis covered roughly 400 flaw types (CWE) — for comparison, in 2017 there were 30.
• The ordering used the incidence rate — the share of applications in which a weakness appeared at least once. What counts is how many applications had the problem at all, not how many times it was reported in total. This stops heavily reported flaws (such as XSS) from distorting the picture.
• Ratings for how easy a flaw is to exploit (exploitability) and how damaging it is (impact) were derived from normalized CVSS scores — the standard scale for rating vulnerabilities.

OWASP refreshes the list every few years (typically every 2-3 years) to keep up with new technologies and attack techniques.

The OWASP Top 10:2021 list (A01-A10)

1. A01:2021 – Broken Access Control — the application enforces permissions poorly, so a user can do more than they should. A typical example is reaching another person’s data by swapping an identifier in the URL (known as IDOR). This category moved up from fifth place in 2017 to first.
2. A02:2021 – Cryptographic Failures — previously called “Sensitive Data Exposure”. It covers missing encryption or its incorrect use, which lets sensitive data leak: weak algorithms, sending data in cleartext, badly stored keys.
3. A03:2021 – Injection — the application takes user input and, by oversight, treats it as its own command. This is how SQL/NoSQL injection or OS command injection work. Cross-Site Scripting (XSS) was also moved into this category. It dropped from first to third place.
4. A04:2021 – Insecure Design — a new category. It is about flaws in the very idea behind the application, before any code is written. Such flaws cannot be “patched” with a fix — the design has to be rethought (for example through threat modeling).
5. A05:2021 – Security Misconfiguration — default passwords, unnecessary services left on, excessive privileges, lack of hardening. It absorbed the former XXE (XML External Entities) category.
6. A06:2021 – Vulnerable and Outdated Components — using libraries and dependencies with known holes. It ties in with software composition analysis (SCA) and watching the supply chain.
7. A07:2021 – Identification and Authentication Failures — previously “Broken Authentication”. Weak passwords, susceptibility to automated reuse of stolen credentials (credential stuffing), session-handling flaws, no multi-factor authentication (MFA).
8. A08:2021 – Software and Data Integrity Failures — a new category about the supply chain and automated build pipelines (CI/CD). It is about failing to check whether an update or dependency was swapped out along the way.
9. A09:2021 – Security Logging and Monitoring Failures — the application does not record events or raise alerts, so an attack goes unnoticed and cannot be investigated afterwards.
10. A10:2021 – Server-Side Request Forgery (SSRF) — a new category, the top entry in the survey. The attacker tricks the server into fetching a resource from an address they control. This way they can reach internal services or cloud data that is off-limits from the outside.

What changed from OWASP Top 10:2017?

• Three new categories: A04 Insecure Design, A08 Software and Data Integrity Failures, and A10 Server-Side Request Forgery (SSRF).
• Renames and rescoping: A02 (former Sensitive Data Exposure → Cryptographic Failures) and A07 (former Broken Authentication → Identification and Authentication Failures).
• Merged categories: XSS moved into Injection (A03), and XXE into Security Misconfiguration (A05).
• New ordering: Broken Access Control rose to A01, while Injection fell to A03.

How does the OWASP Top 10 differ from the OWASP API Security Top 10?

The OWASP Top 10 covers web applications in general. Alongside it there is a separate list, the OWASP API Security Top 10 (latest edition from 2023), which focuses only on APIs — that is, on how applications talk to each other behind the scenes. The lists partly overlap (access control, misconfiguration, SSRF), but the API list stresses flaws in authorization logic and abuse of business processes, which ordinary scanners detect poorly. The 2023 categories:

• API1:2023 Broken Object Level Authorization (BOLA)
• API2:2023 Broken Authentication
• API3:2023 Broken Object Property Level Authorization
• API4:2023 Unrestricted Resource Consumption
• API5:2023 Broken Function Level Authorization
• API6:2023 Unrestricted Access to Sensitive Business Flows
• API7:2023 Server Side Request Forgery
• API8:2023 Security Misconfiguration
• API9:2023 Improper Inventory Management
• API10:2023 Unsafe Consumption of APIs

Beyond these two, OWASP also maintains related lists — including ones for mobile applications and for applications built on large language models (LLMs).

Why does the OWASP Top 10 matter for monitoring and detection?

The OWASP Top 10 describes flaws at the code and configuration level. But many of them leave traces that show up in network traffic and logs. That makes the list useful not only for developers, but also for the teams that defend networks — the SOC (security operations center) and NDR (detecting threats in network traffic):

• A01/A07 (access control and authentication): unusual request patterns, stepping through identifiers (IDOR) or sudden bursts of failed logins are visible in application logs and HTTP traffic.
• A03 (Injection): characteristic data in queries is caught by web application firewalls (WAFs) and application-layer analysis. Without logs (that is, without A09) such attacks can be invisible after the fact.
• A09 (logging and monitoring): a category explicitly about telemetry. Weak logging and missing alerts lengthen the time an attacker stays unnoticed and make later investigation harder.
• A10 (SSRF): shows up as odd outbound traffic from a server — to internal addresses, to a cloud metadata service (e.g. 169.254.169.254) or to unexpected domains. It is a signal visible in flow monitoring and DNS queries.
• A06 (vulnerable components): attempts to exploit known holes (CVEs) leave recognizable scanning traces. Matching them against an inventory of the libraries in use speeds up the response.

The list does not replace a full security program, but it gives developers and defenders a shared language: the same categories help set priorities both when fixing code and when writing detection rules on the network.

Learn more

• Application Layer Attack (L7) — OWASP Top 10 includes web app flaws often exploited through Layer 7 attacks.
• Cross-Site Request Forgery (CSRF) — CSRF is a web attack type covered by OWASP Top 10 risk categories.
• PCI-DSS — PCI DSS requires controls that help reduce risks from OWASP Top 10 web vulnerabilities.
• Web Shell Attacks — Web shells can follow OWASP Top 10 flaws that let attackers upload or execute code.
• SaaS Security Posture Management (SSPM) — SSPM helps find SaaS misconfigurations and access issues linked to OWASP Top 10 risks.
• Asset Discovery — Asset discovery helps locate web apps that may contain OWASP Top 10 weaknesses.
• Cloud Security Posture Management (CSPM) — CSPM reduces cloud misconfigurations that can expose apps to OWASP Top 10 attacks.