The current released edition is OWASP Top 10:2025. It helps teams build shared vocabulary and begin security discussions; it is not a security standard, compliance checklist, or complete catalog of application risk.
OWASP combines contributed vulnerability data with community input to select and organize the categories. Each category aggregates multiple weaknesses and scenarios, so its position is not a direct estimate of exploit probability, prevalence, or impact for a particular application.
Key points
2025 categoriesBroken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.
Useful roleUse the document for education, initial review, shared terminology, and as one input when forming application-specific requirements, threat models, tests, and improvement priorities.
Use beyond the listAssess the application’s architecture, technology, data, users, business workflows, dependencies, deployment, and threat environment, then choose requirements and verification depth accordingly.
Important limitationAddressing all ten categories does not demonstrate that an application is secure or compliant. Risks outside the list, flaws within aggregated categories, and application-specific abuse cases may be more important.