OWASP Top 10 for Web Security
Compare official OWASP Top 10 releases, inspect issue rankings over time, and explore security risk evolution.
Official Releases
7
Year Span
2003 - 2025
Tracked Issues
27
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Cross Site Scripting (XSS) | A1 Cross Site Scripting (XSS) covers Cross-Site Scripting (XSS), Injection. | View Details |
| #2 | Injection Flaws | A2 Injection Flaws covers Injection, Cross-Site Scripting (XSS). | View Details |
| #3 | Malicious File Execution | A3 Malicious File Execution covers Insecure Design, Remote Code Execution. | View Details |
| #4 | Insecure Direct Object Reference | A4 Insecure Direct Object Reference covers Insecure Direct Object Reference (IDOR), Broken Access Control. | View Details |
| #5 | Cross Site Request Forgery (CSRF) | A5 Cross Site Request Forgery (CSRF) covers Cross-Site Request Forgery (CSRF). | View Details |
| #6 | Information Leakage and Improper Error Handling | A6 Information Leakage and Improper Error Handling covers Sensitive Data Exposure, Improper Error Handling, Logging and Monitoring Failures. | View Details |
| #7 | Broken Authentication and Session Management | A7 Broken Authentication and Session Management covers Authentication Failures, Session Management. | View Details |
| #8 | Insecure Cryptographic Storage | A8 Insecure Cryptographic Storage covers Cryptographic Failures, Sensitive Data Exposure. | View Details |
| #9 | Insecure Communications | A9 Insecure Communications covers Transport Layer Protection, Cryptographic Failures. | View Details |
| #10 | Failure to Restrict URL Access | A10 Failure to Restrict URL Access covers Broken Access Control. | View Details |