The Open Worldwide Application Security Project (OWASP) is a global, open community that provides guidance, tools, and best practices for improving application security. The OWASP Top 10 is the most widely recognized awareness document for developers, security professionals, and organizations to understand the most critical web application security risks.
Compared to OWASP Top 10:2021, the OWASP Top 10:2025 introduces two new categories:
- Software Supply Chain Failures
- Mishandling of Exceptional Conditions
These additions reflect the growing importance of securing third-party software dependencies and properly handling application errors.
The OWASP Top 10 represents the minimum security standard that every web application should follow. While implementing these recommendations does not guarantee complete security, it significantly reduces common application security risks. OWASP also provides detailed OWASP Cheat Sheets, which explain security issues and secure coding practices in depth.
OWASP Top 10:2025 List
You can click each item below to learn more about that specific vulnerability.
- Broken Access Control
- Security Misconfiguration
- Software Supply Chain Failures
- Cryptographic Failures
- Injection
- Insecure Design
- Authentication Failures
- Software or Data Integrity Failures
- Security Logging and Alerting Failures
- Mishandling of Exceptional Conditions
Brief Description of OWASP Top 10:2025 Categories
1. Broken Access Control (A01)
Occurs when an application allows unauthorized users to access data or perform actions beyond their intended permissions.
2. Security Misconfiguration (A02)
Occurs when an application, server, or software is improperly configured, leaving security settings weak or incomplete.
3. Software Supply Chain Failures (A03)
Occurs when software dependencies, third-party components, build systems, or deployment processes are compromised or used without proper integrity and security verification.
4. Cryptographic Failures (A04)
Occurs when sensitive data is not properly encrypted while stored (at rest) or transmitted (in transit), exposing it to attackers.
5. Injection (A05)
Occurs when untrusted user input is interpreted as commands or queries by an interpreter, leading to unintended execution.
6. Insecure Design (A06)
Occurs when security flaws exist in the application’s design or architecture, making the application vulnerable even if implemented correctly.
7. Authentication Failures (A07)
Occurs when an attacker tricks the application into treating an unauthorized user as a legitimate user.
8. Software or Data Integrity Failures (A08)
Occurs when applications execute or trust code, software, or infrastructure components without verifying their integrity and authenticity.
9. Security Logging and Alerting Failures (A09)
Occurs when applications fail to generate adequate logs or security alerts, making it difficult to detect, investigate, or respond to attacks.
10. Mishandling of Exceptional Conditions (A10)
Occurs when an application fails to properly handle unexpected errors or exceptional situations, potentially exposing sensitive information or introducing additional security vulnerabilities.
The OWASP Top 10:2025 highlights the most critical security risks affecting modern web applications. Understanding these vulnerabilities helps developers, testers, and security professionals build more secure applications and reduce the overall attack surface. Following the OWASP recommendations, along with the OWASP Cheat Sheets, is an excellent starting point for implementing secure development practices and improving application security.
