The OWASP Top 10 is the most widely used awareness list for web application risk. The 2025 edition maps nearly 250 CWEs to ten categories; each page explains one category and links the guides on this site that address it.
| Risk | Summary | Guides here |
|---|---|---|
| A01:2025 Broken Access Control | Users act outside their intended permissions, reading or changing other users' data or reaching functions they should not; the 2025 edition also folds SSRF into this category. | 21 |
| A02:2025 Security Misconfiguration | Insecure settings anywhere in the stack: unhardened components, unnecessary features, default accounts, overly detailed errors, missing security headers or overly broad cloud permissions. | 15 |
| A03:2025 Software Supply Chain Failures | Weakness or compromise in how software is built, distributed or updated, including vulnerable, unmaintained or malicious dependencies and build pipelines weaker than what they produce. | 24 |
| A04:2025 Cryptographic Failures | Missing, weak or misused cryptography, such as cleartext transport, obsolete algorithms or modes, poor key management, weak randomness or unvalidated certificates, exposing or corrupting data. | 21 |
| A05:2025 Injection | Untrusted input is interpreted as code or commands by an interpreter such as SQL, a shell, HTML or JavaScript, LDAP or a template engine; includes cross-site scripting. | 18 |
| A06:2025 Insecure Design | Needed controls were never designed or are ineffective for the threats faced, for example missing threat modeling or unsafe business logic, so a flawless implementation cannot fix it. | 10 |
| A07:2025 Authentication Failures | Weaknesses in confirming identity and managing sessions: brute force and credential stuffing, weak recovery, flawed session handling, and improper certificate or token validation. | 18 |
| A08:2025 Software or Data Integrity Failures | Code or data is trusted without verifying its integrity, such as unsigned updates, untrusted plugins or CDNs, unverified CI/CD artifacts, and insecure deserialization. | 17 |
| A09:2025 Security Logging and Alerting Failures | Security-relevant events are not recorded, protected or turned into timely alerts, so attacks go unnoticed and investigations lack evidence. | 4 |
| A10:2025 Mishandling of Exceptional Conditions | The application fails to prevent, detect or respond safely to errors and unusual states, for example failing open, leaking details or leaving inconsistent state. | 3 |
Entries from OWASP Top 10:2025. “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.