Say which edition you mean
Editions differ enough that an unqualified "the OWASP Top 10" is ambiguous. Injection was #1 in 2017, #3 in 2021 and is #5 in 2025. SSRF had its own entry in 2021 and does not now. Three categories were renamed in 2025 alone.
Why it is like this
The list is revised every few years against fresh data, so drift is the design working. The cost falls on everything built against a given edition: policies, scanner profiles, training, contract clauses.
Not to be confused with
Pedantry. A supplier contract requiring coverage of "the OWASP Top 10" without a year is unenforceable in one direction and unboundedly expanding in the other.
In practice
Cite the edition, as OWASP Top 10:2025 — the project numbers its entries that way for exactly this reason.
Source: OWASP Top 10:2025 — Introduction, What's changed. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Say it back Check yourself
Name three things that differ between the 2021 and 2025 lists.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Two new categories: A03 Software Supply Chain Failures (expanded from Vulnerable and Outdated Components) and A10 Mishandling of Exceptional Conditions
- SSRF lost its standalone entry and was rolled into A01 Broken Access Control
- Security Misconfiguration rose from #5 to #2
- Cryptographic Failures fell from #2 to #4, Injection from #3 to #5, Insecure Design from #4 to #6
- Renames: Identification and Authentication Failures to Authentication Failures; Software and/or Data Integrity Failures; Logging and Monitoring to Logging and Alerting
Any three. If a colleague cites a position without a year, one of you is probably working from a different list.