# What is the OWASP Top 10?

> The OWASP Top 10 is a periodically updated awareness document from the Open Worldwide Application Security Project (OWASP) that groups and explains ten of the most significant categories of web application security risk.

- Canonical URL: https://yellowcube.eu/glossary/open-worldwide-application-security-project-top-10/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The current released edition is OWASP Top 10:2025. It helps teams build shared vocabulary and begin security discussions; it is not a security standard, compliance checklist, or complete catalog of application risk.

OWASP combines contributed vulnerability data with community input to select and organize the categories. Each category aggregates multiple weaknesses and scenarios, so its position is not a direct estimate of exploit probability, prevalence, or impact for a particular application.

### Key points

- **2025 categories:** Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.
- **Useful role:** Use the document for education, initial review, shared terminology, and as one input when forming application-specific requirements, threat models, tests, and improvement priorities.
- **Use beyond the list:** Assess the application’s architecture, technology, data, users, business workflows, dependencies, deployment, and threat environment, then choose requirements and verification depth accordingly.
- **Important limitation:** Addressing all ten categories does not demonstrate that an application is secure or compliant. Risks outside the list, flaws within aggregated categories, and application-specific abuse cases may be more important.

### Related terms

[Application security](<https://yellowcube.eu/glossary/application-security/>) · [Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Security misconfiguration](<https://yellowcube.eu/glossary/security-misconfiguration/>) · [Software supply-chain security](<https://yellowcube.eu/glossary/software-supply-chain-security/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>)

### Sources

[OWASP Top 10:2025](https://owasp.org/Top10/) · [OWASP Top 10:2025 introduction](https://owasp.org/Top10/2025/0x00_2025-Introduction/) · [OWASP Top Ten project](https://owasp.org/www-project-top-ten/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.