OWASP Top 10:2025 · pillar 2 of 6
What is new in 2025
Two new categories, one consolidation, and four names that changed under people.
- 4 A03: Software Supply Chain Failures A03:2025 Software Supply Chain Failures is an expansion of 2021's Vulnerable and Outdated Components, widened to the…
- 5 A10: Mishandling of Exceptional Conditions A10:2025 Mishandling of Exceptional Conditions is the other new category. It covers improper error handling, logical…
- 6 Four names changed, and SSRF moved house Three categories were renamed and one was merged. Identification and Authentication Failures is now Authentication…
Start this pillar See the whole map
Read against OWASP Top 10:2025 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.