The 2025 OWASP Top 10 combines testing data contributed from over 2.8 million applications, CVE data for exploit and impact scoring, and a community survey. Eight categories came from the data and the survey could promote two more. It is a consensus awareness document, not a measurement of your own risk.
Contributed testing data
According to the introduction to the 2025 edition, contributors reported how many applications they tested each year and how many had at least one instance of each weakness (CWE). Frequency of instances was ignored. One application with one hundred cases counts the same as one with a single case.
The dataset covered over 2.8 million applications, and 589 CWEs were analyzed, compared with almost 400 in 2021. The final list groups 248 CWEs across its ten categories, out of 968 in the MITRE dictionary. Categories average about 25 CWEs, from 5 up to a cap of 40.
Exploit and impact scoring
Exploitability and technical impact came from CVE data, grouped by CWE. The introduction says this data was extracted from OWASP Dependency Check and held about 175 thousand CVE to CWE records covering 643 unique CWEs. Scores were weighted by the share of CVSS v3 and v2 coverage. CVSS v4 was not used, because its scoring changed and no longer readily gives separate exploit and impact scores.
The community survey
The authors describe ranking twelve categories from data and letting the survey promote or highlight two. The survey is there to catch risks that automated testing data may miss. The text names A03 and A09 as categories that survey respondents voted for.
What this means in practice
Three cautions follow.
- Data comes from testing programs. Risks that are hard to test automatically are under-represented, which is why the survey exists.
- Counting presence, not volume. A category ranks high because many applications have at least one instance, not because each has many.
- It describes the industry, not you. Your own findings matter more than a global ranking.
When a vendor says it covers the Top 10, ask how it covers each category and with what evidence. A mapping table is a start, not proof. Ask to see detections on a sample project. Our post on what changed from 2021 to 2025 lists the category moves.
Using the list in your own program
Treat the list as a vocabulary, not a scoreboard. It gives developers, testers and buyers a shared set of names for common problems. That alone is valuable, because it lets a security review say "access control" and mean the same thing in every team.
Then replace the global ranking with your own. Count findings by category in your last two quarters of testing, bug reports and incidents, and see whether your order matches the published one. If your top category differs from the published list, trust your data and plan around it.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, and policies and gates. You can try the free scan at gold.safeguard.sh/scan and compare it to your own expectations.
Quick check
Does the Top 10 count how many flaws each application has?
No. According to the introduction, contributors reported how many applications had at least one instance, and frequency of instances was ignored.
Why a survey on top of the data?
The authors say it is meant to capture risks that automated testing data may miss.
Sources
Last reviewed: 19 October 2026.
