OWASP Top 10:2025 · pillar 1 of 6
What the list is
A risk-awareness document built from data and a survey — not a standard, and not a list of bugs.
- 1 It is an awareness document, not a standard The Top 10 is a standard awareness document describing the most critical security risks to web applications. It is not…
- 2 Data-informed, not data-driven Eight entries are ranked from contributed data — twelve categories were ranked and the top eight taken — and two are…
- 3 The entries are categories of CWEs Each entry is a category grouping many Common Weakness Enumerations, not a single vulnerability. A01 covers roughly…
Start this pillar See the whole map
Read against OWASP Top 10:2025 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.