OWASP Top 10:2025: the 10 categories, explained

The OWASP Top 10 is a standard awareness document from the Open Worldwide Application Security Project (OWASP) listing what the project calls, in its own words, "a broad consensus about the most critical security risks to web applications." OWASP Top 10:2025 is the current, eighth edition — following 2003, 2004, 2007, 2010, 2013, 2017 and 2021 — announced as a release candidate at the OWASP Global AppSec Conference in November 2025, with OWASP's own GitHub repository README now describing it as released and "Final."

The 10 categories

Per OWASP's own published list:

Code	Category	2021 rank
A01:2025	Broken Access Control	#1
A02:2025	Security Misconfiguration	#5
A03:2025	Software Supply Chain Failures	new (expanded from A06:2021)
A04:2025	Cryptographic Failures	#2
A05:2025	Injection	#3
A06:2025	Insecure Design	#4
A07:2025	Authentication Failures	#7 (renamed from "Identification and Authentication Failures")
A08:2025	Software or Data Integrity Failures	#8
A09:2025	Security Logging & Alerting Failures	#9 (renamed from "Security Logging and Monitoring Failures")
A10:2025	Mishandling of Exceptional Conditions	new

A01:2025 Broken Access Control holds the #1 spot it also held in 2021. OWASP's own category page describes it as failures where "users cannot act outside of their intended permissions," covering violations of least privilege, URL-parameter tampering, insecure direct object references, missing API-level authorization checks, JWT/cookie tampering, CORS misconfiguration and forced browsing. It is now the single largest category by scope: OWASP's own data states 40 CWEs map to it, with a maximum incidence rate of 20.15% across tested applications, 1,839,701 total occurrences and 32,654 total CVEs — and 2021's standalone Server-Side Request Forgery (SSRF) category was folded into it for 2025.

A03:2025 Software Supply Chain Failures is the edition's most consequential new category. OWASP's own text describes it as "breakdowns or other compromises in the process of building, distributing, or updating software," evolved from 2021's narrower "Vulnerable and Outdated Components" (itself tracing back to 2013's "Using Components with Known Vulnerabilities"). Only 6 CWEs map to it — the narrowest category in the list — but OWASP's data notes it carries the highest average exploit and impact severity among mapped CVEs, and it ranked #1 in OWASP's community survey with exactly 50% of respondents placing it first, despite a comparatively low measured incidence rate in the automated test data. OWASP's own category page cites the 2019 SolarWinds compromise (~18,000 organizations affected through a trusted vendor) and the 2025 npm "Shai-Hulud" worm (self-propagating across 500+ package versions) as example attack scenarios.

The methodology: data-driven plus community survey

OWASP's own "What Are Application Security Risks" page describes a hybrid process. The quantitative side draws on roughly 175,000 CVE records mapped to CWEs from the National Vulnerability Database (up from about 125,000 records behind the 2021 edition), covering 643 unique CWEs mapped to those CVEs (up from 241 in 2021) and contributed vulnerability-testing data from 13 organizations plus several anonymous donors across more than 2.8 million tested applications. From that pool, 248 CWEs were grouped into the 10 final categories, averaging 25 CWEs per category (ranging from 6 in Software Supply Chain Failures up to 40 in Broken Access Control). Risk ranking combines incidence rate, exploit score, impact score and total occurrence count into a single weighted formula per OWASP's own published methodology.

The qualitative side is OWASP's community survey: per the project's own introduction, "we ranked [candidate] categories based on the data contributed, and allowed two to be promoted or highlighted by responses from the community survey" — which is how Software Supply Chain Failures and Mishandling of Exceptional Conditions earned slots despite the data-only ranking alone not necessarily placing them in the top 10. OWASP frames this explicitly as a way to surface risks that automated vulnerability scanning underrepresents, such as a rare-but-catastrophic supply-chain compromise.

License

The OWASP/Top10 GitHub repository — the source of the published document — carries a LICENSE file identifying the Creative Commons Attribution-ShareAlike 4.0 International Public License, meaning the Top 10 text can be reused and adapted with attribution, provided derivative works carry an equivalent CC license.

Where this fits for a device or firmware maker

The OWASP Top 10 is scoped to web application risks specifically, rather than embedded firmware or OT protocols — for those, see our guides on the OWASP IoT Top 10 and OWASP ASVS for a more rigorous, testable verification standard. But most connected devices now ship a web-based management UI or cloud API, which makes the 2025 list directly relevant: A01 Broken Access Control and A03 Software Supply Chain Failures in particular map closely onto the device-update and component-provenance questions covered in our firmware SBOM and CSAF/VEX for device makers guides, and onto the API-specific risks in our OWASP API Security Top 10 guide for devices exposing a dedicated API rather than a browser UI.

SoftWSP can help assess a device's web management interface or cloud API against the current OWASP Top 10 and API Security Top 10 together: see device firmware security.

This guide summarises OWASP's own public Top 10:2025 publication; it does not constitute legal or compliance advice.