OWASP Top 10 for Web Security
Compare official OWASP Top 10 releases, inspect issue rankings over time, and explore security risk evolution.
Official Releases
7
Year Span
2003 - 2025
Tracked Issues
27
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Broken Access Control | A01 Broken Access Control covers Broken Access Control, Insecure Direct Object Reference (IDOR). | View Details |
| #2 | Cryptographic Failures | A02 Cryptographic Failures covers Cryptographic Failures, Sensitive Data Exposure, Transport Layer Protection. | View Details |
| #3 | Injection | A03 Injection covers Injection, Cross-Site Scripting (XSS), Input Validation. | View Details |
| #4 | Insecure Design | A04 Insecure Design covers Insecure Design. | View Details |
| #5 | Security Misconfiguration | A05 Security Misconfiguration covers Security Misconfiguration, XML External Entities (XXE). | View Details |
| #6 | Vulnerable and Outdated Components | A06 Vulnerable and Outdated Components covers Vulnerable and Outdated Components, Software Supply Chain Failures. | View Details |
| #7 | Identification and Authentication Failures | A07 Identification and Authentication Failures covers Authentication Failures, Session Management. | View Details |
| #8 | Software and Data Integrity Failures | A08 Software and Data Integrity Failures covers Software and Data Integrity Failures. | View Details |
| #9 | Security Logging and Monitoring Failures | A09 Security Logging and Monitoring Failures covers Logging and Monitoring Failures. | View Details |
| #10 | Server-Side Request Forgery (SSRF) | A10 Server-Side Request Forgery (SSRF) covers Server-Side Request Forgery (SSRF). | View Details |