OWASP Top 10 for Web Security
Compare official OWASP Top 10 releases, inspect issue rankings over time, and explore security risk evolution.
Official Releases
7
Year Span
2003 - 2025
Tracked Issues
27
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Injection | A1 Injection covers Injection, Cross-Site Scripting (XSS). | View Details |
| #2 | Broken Authentication | A2 Broken Authentication covers Authentication Failures, Session Management. | View Details |
| #3 | Sensitive Data Exposure | A3 Sensitive Data Exposure covers Sensitive Data Exposure, Cryptographic Failures. | View Details |
| #4 | XML External Entities (XXE) | A4 XML External Entities (XXE) covers XML External Entities (XXE), Insecure Design. | View Details |
| #5 | Broken Access Control | A5 Broken Access Control covers Broken Access Control, Insecure Direct Object Reference (IDOR). | View Details |
| #6 | Security Misconfiguration | A6 Security Misconfiguration covers Security Misconfiguration. | View Details |
| #7 | Cross-Site Scripting (XSS) | A7 Cross-Site Scripting (XSS) covers Cross-Site Scripting (XSS), Injection. | View Details |
| #8 | Insecure Deserialization | A8 Insecure Deserialization covers Software and Data Integrity Failures, Insecure Design. | View Details |
| #9 | Using Components with Known Vulnerabilities | A9 Using Components with Known Vulnerabilities covers Vulnerable and Outdated Components, Software Supply Chain Failures. | View Details |
| #10 | Insufficient Logging and Monitoring | A10 Insufficient Logging and Monitoring covers Logging and Monitoring Failures. | View Details |