The 2025 List
- A01 Broken Access Control. Still first, and now includes server-side request forgery (SSRF).
- A02 Security Misconfiguration. Up from fifth in 2021.
- A03 Software Supply Chain Failures. New. Expands "Vulnerable and Outdated Components" to the whole supply chain, including build systems and distribution.
- A04 Cryptographic Failures. Down from second.
- A05 Injection. Down from third.
- A06 Insecure Design. Down from fourth.
- A07 Authentication Failures.
- A08 Software or Data Integrity Failures.
- A09 Security Logging and Alerting Failures.
- A10 Mishandling of Exceptional Conditions. New. Covers improper error handling, logic errors and systems that fail open.
How the List Was Built
OWASP analysed more than 175,000 CVE records mapped to 589 Common Weakness Enumerations, up from about 400 in 2021, and combined that data with a community survey. The survey matters because testing data looks backwards; it lets practitioners flag risks that are rising before they show up in statistics.
What the Changes Mean
Your dependencies are now your attack surface. A03 has the fewest occurrences in testing data but the highest average exploit and impact scores. A compromised library, base image or build step reaches every customer at once.
Configuration is code. Misconfiguration's rise to second reflects cloud and container sprawl: default credentials, open storage and verbose errors now cause more incidents than most coding mistakes.
Failure paths need testing too. A10 asks what happens when things go wrong. A check that throws an exception and lets the request through is as dangerous as no check at all.
How to Test for the New Categories
- Supply chain: maintain a software bill of materials, scan dependencies and base images on every build, verify that artefacts are signed, and lock down who can change the pipeline.
- Exceptional conditions: inject faults deliberately (timeouts, malformed input, unavailable services) and confirm the system fails closed without leaking internal detail.
- Access control and SSRF together: test object-level permissions for every role, and check whether user-supplied URLs can reach internal services.
How CyberrGuard Tests Against the OWASP Top 10
Every web VAPT we run covers all ten categories, plus business logic abuse that automated scanners miss. Our DevSecOps integration adds software bill of materials, dependency and container checks to your pipeline, so A03 issues are caught on every build rather than once a year.