OWASP Top 10 for Web Security
Compare official OWASP Top 10 releases, inspect issue rankings over time, and explore security risk evolution.
Official Releases
7
Year Span
2003 - 2025
Tracked Issues
27
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| ALL TIME | Issue | Summary | Details |
|---|---|---|---|
| #1 | Unvalidated Input | A1 Unvalidated Input covers Injection, Cross-Site Scripting (XSS), Input Validation. | View Details |
| #2 | Broken Access Control | A2 Broken Access Control covers Broken Access Control, Insecure Direct Object Reference (IDOR). | View Details |
| #3 | Unvalidated Input | A1 Unvalidated Input covers Injection, Cross-Site Scripting (XSS), Input Validation. | View Details |
| #4 | Broken Access Control | A2 Broken Access Control covers Broken Access Control, Insecure Direct Object Reference (IDOR). | View Details |
| #5 | Broken Access Control | A2 Broken Access Control covers Broken Access Control, Insecure Direct Object Reference (IDOR). | View Details |
| #6 | Broken Authentication and Session Management | A3 Broken Authentication and Session Management covers Authentication Failures, Session Management. | View Details |
| #7 | Broken Authentication and Session Management | A3 Broken Authentication and Session Management covers Authentication Failures, Session Management. | View Details |
| #8 | Insecure Storage | A8 Insecure Storage covers Cryptographic Failures, Sensitive Data Exposure. | View Details |
| #9 | Insecure Storage | A8 Insecure Storage covers Cryptographic Failures, Sensitive Data Exposure. | View Details |
| #10 | Insecure Configuration Management | A10 Insecure Configuration Management covers Security Misconfiguration. | View Details |