OWASP¶
The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.
They provide resources, tools, and best practices for web application security.
OWASP Top 10¶
One of their most well-known projects is the OWASP Top Ten/ OWASP Top 10, which is a list of the most critical web application security risks.
The OWASP Top Ten is updated every few years to reflect the evolving threat landscape.
The last version was released in 2021, and the latest version is currently being developed for 2025, though it’s basically been finalized.
Here’s the current list of 2025 OWASP Top 10:
| Rank | Category |
|---|---|
| A01:2025 | Broken Access Control (OWASP) |
| A02:2025 | Security Misconfiguration (OWASP) |
| A03:2025 | Software Supply Chain Failures (OWASP) |
| A04:2025 | Cryptographic Failures (Orca Security) |
| A05:2025 | Injection (OWASP) |
| A06:2025 | Insecure Design (Invicti) |
| A07:2025 | Authentication Failures (Orca Security) |
| A08:2025 | Software or Data Integrity Failures (OWASP) |
| A09:2025 | Logging & Alerting Failures (OWASP) |
| A10:2025 | Mishandling of Exceptional Conditions (fastly.com) |
- Broken Access Control: Restrictions on what authenticated users are allowed to do are often not properly enforced.
- Security Misconfiguration: Insecure default configurations, incomplete, or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.
- Software Supply Chain Failures: Vulnerabilities in third-party components, libraries, and frameworks.
- Cryptographic Failures: Inadequate protection of data in transit and at rest.
- Injection: Flaws such as SQL, NoSQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query.
- Insecure Design: Lack of security controls and design flaws.
- Authentication Failures: Broken authentication and session management.
- Software or Data Integrity Failures: Code and infrastructure that does not protect against integrity violations.
- Logging & Alerting Failures: Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response.
- Mishandling of Exceptional Conditions: Errors and exceptions that are not properly handled, leading to information leakage or system crashes. The highest ones aren’t necessarily the most common, but the most critical if they were to occur.