OWASP Top 10 for Web Security
Compare official OWASP Top 10 releases, inspect issue rankings over time, and explore security risk evolution.
Official Releases
7
Year Span
2003 - 2025
Tracked Issues
27
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Broken Access Control | A01 Broken Access Control covers Broken Access Control, Insecure Direct Object Reference (IDOR). | View Details |
| #2 | Security Misconfiguration | A02 Security Misconfiguration covers Security Misconfiguration. | View Details |
| #3 | Software Supply Chain Failures | A03 Software Supply Chain Failures covers Software Supply Chain Failures, Vulnerable and Outdated Components. | View Details |
| #4 | Cryptographic Failures | A04 Cryptographic Failures covers Cryptographic Failures, Sensitive Data Exposure, Transport Layer Protection. | View Details |
| #5 | Injection | A05 Injection covers Injection, Cross-Site Scripting (XSS), Input Validation. | View Details |
| #6 | Insecure Design | A06 Insecure Design covers Insecure Design. | View Details |
| #7 | Authentication Failures | A07 Authentication Failures covers Authentication Failures, Session Management. | View Details |
| #8 | Software or Data Integrity Failures | A08 Software or Data Integrity Failures covers Software and Data Integrity Failures. | View Details |
| #9 | Security Logging and Alerting Failures | A09 Security Logging and Alerting Failures covers Logging and Monitoring Failures. | View Details |
| #10 | Mishandling of Exceptional Conditions | A10 Mishandling of Exceptional Conditions covers Improper Error Handling, Availability and Resilience. | View Details |