The OWASP Top 10 is a periodically updated ranking of the most critical security risks facing web applications, maintained by the Open Web Application Security Project. It is not a specific list of bugs to grep for — each entry is a category of related weaknesses, ranked by how often it appears in real breaches and how much damage it tends to cause. The current official edition is OWASP Top 10:2021, and it remains the reference most compliance frameworks, security questionnaires, and application security tooling cite as of 2026.
What changed in 2026
- Broken Access Control held the #1 spot for a second consecutive edition, reflecting how often authorization logic, not authentication or cryptography, is where real breaches originate.
- SSRF's standalone category kept proving relevant. Server-Side Request Forgery, added as its own category in 2021, remains a recurring vector as more apps fetch attacker-influenced URLs and cloud metadata endpoints stay under-protected.
- Supply chain risk widened in practice. The Software and Data Integrity Failures category increasingly covers ML and AI dependency risks — unsafe model deserialization, poisoned packages — as machine learning tooling became a standard part of mainstream app stacks.
- The next full revision is still in progress. OWASP opened data collection and community review for the next edition, but as of 2026 no new full release has superseded 2021 — treat any claimed newer "Top 10" list circulating outside owasp.org with skepticism until OWASP publishes it directly.
- The LLM-specific Top 10 became a companion list, not a replacement. AI-specific risks (see OWASP's LLM Top 10 explained) get their own ranking; they do not retire any of the general web categories below.
The ten categories
| Rank |
Category |
What it covers |
| A01 |
Broken Access Control |
Users acting outside their intended permissions — accessing other accounts' data, bypassing authorization checks |
| A02 |
Cryptographic Failures |
Weak, missing, or misused encryption exposing sensitive data in transit or at rest |
| A03 |
Injection |
Untrusted input interpreted as code or commands — SQL, OS command, LDAP, and similar injection |
| A04 |
Insecure Design |
Missing or ineffective security controls baked into the architecture itself, not just implementation bugs |
| A05 |
Security Misconfiguration |
Default credentials, verbose errors, unnecessary features enabled, missing hardening |
| A06 |
Vulnerable and Outdated Components |
Using libraries or frameworks with known vulnerabilities or no longer supported |
| A07 |
Identification and Authentication Failures |
Weak session management, credential stuffing exposure, missing multi-factor options |
| A08 |
Software and Data Integrity Failures |
Unverified updates, plugins, or CI/CD pipelines; unsafe deserialization |
| A09 |
Security Logging and Monitoring Failures |
Insufficient logging that delays breach detection and incident response |
| A10 |
Server-Side Request Forgery (SSRF) |
Application fetches attacker-controlled or attacker-influenced URLs, reaching internal systems |
How to actually use the list
Treat the Top 10 as a prioritization tool, not a compliance checklist. Map each category to concrete controls in your stack: access control reviews and deny-by-default authorization for A01, dependency scanning in CI for A06, structured logging with alerting for A09, and an allowlist for any server-side outbound fetch to address A10. A design and code review pass that only checks for the literal ten category names, without asking how each applies to your specific architecture, misses most of the value — consulting established design patterns for input validation and authorization boundaries closes more real gaps than a checkbox pass.
Common mistakes
Treating the Top 10 as exhaustive. It ranks the most common categories, not every possible vulnerability — a clean Top 10 audit is not the same as a comprehensive security review.
Fixing the symptom, not the category. Patching one SQL injection point without reviewing all input handling for the same pattern leaves the underlying A03 gap open elsewhere in the codebase.
Ignoring A04, Insecure Design, because it feels abstract. Unlike a specific bug, insecure design requires threat modeling during architecture, not just a code scan — skipping it means later categories keep recurring.
Assuming authentication failures and access control failures are the same problem. A07 is about proving who you are; A01 is about what you are allowed to do once authenticated. Fixing login security does not fix authorization bugs.
FAQ
How often does OWASP update the Top 10?
Roughly every three to four years historically — 2013, 2017, and 2021 — based on submitted vulnerability data and community review, not a fixed annual schedule.
Is the OWASP Top 10 a compliance requirement?
Not by itself, but many compliance frameworks and security questionnaires reference it as a baseline, so addressing it is often a practical prerequisite for passing audits.
Does the OWASP Top 10 cover AI and LLM risks?
The general web Top 10 does not focus on them specifically. OWASP maintains a separate, dedicated list for large language model applications covering risks like prompt injection.
What is the difference between Injection and SSRF?
Injection (A03) is about untrusted input being interpreted as code or commands within your own system. SSRF (A10) is about your server being tricked into making unintended requests to other systems, including internal ones.
Where to go next