The current edition is OWASP Top 10:2025. Broken Access Control stays at number one and Security Misconfiguration rises to number two. Two categories are new: Software Supply Chain Failures at A03 and Mishandling of Exceptional Conditions at A10. Here are all ten, with what moved since 2021.
The ten categories
According to the OWASP introduction for the 2025 edition:
- A01 Broken Access Control. Stays at number one. Server-Side Request Forgery was folded into it.
- A02 Security Misconfiguration. Up from number five, because misconfigurations appeared more often in the data.
- A03 Software Supply Chain Failures. New. It broadens the 2021 category Vulnerable and Outdated Components to the wider software ecosystem.
- A04 Cryptographic Failures. Down from number two.
- A05 Injection. Down from number three.
- A06 Insecure Design. Down from number four.
- A07 Authentication Failures. Stays at seven. Renamed from Identification and Authentication Failures to better match its weakness types.
- A08 Software or Data Integrity Failures. Stays at eight. It focuses on trust boundaries and the integrity of code and data below the supply chain level.
- A09 Security Logging and Alerting Failures. Stays at nine. Renamed to stress that alerting is needed to act on events.
- A10 Mishandling of Exceptional Conditions. New. It covers improper error handling, logical errors and failing open.
What the changes suggest
The new supply chain category reflects that risk now comes from the build, packages and delivery process, not only from known vulnerable libraries. Teams should look at how dependencies arrive, not just at what version they are.
The new A10 asks you to check what your code does when something unexpected happens. A system that fails open on an error is an access control problem waiting to happen.
How to use the list
- Treat it as an awareness document, not a complete standard. It is a ranked list of common risks.
- Map each category to a concrete test or review step in your pipeline.
- Start with the top two, since access control and configuration mistakes recur across most applications.
- Use a verification standard if you need requirements to test against.
Quick wins by category
- Access control: deny by default and test that one user cannot read another's data.
- Misconfiguration: keep a baseline for each environment and check for drift.
- Supply chain: keep an inventory of dependencies and know where each comes from.
- Exceptional conditions: test error paths on purpose, including timeouts and malformed input.
Where Safeguard fits
For A03, Safeguard offers SBOM and dependency scanning with reachability analysis. The free scan at gold.safeguard.sh/scan gives a first look at a project's dependencies.
Quick check
Is the Top 10 a compliance standard?
No. It is an awareness list. Some contracts reference it, so check the wording.
What is new in 2025?
Software Supply Chain Failures and Mishandling of Exceptional Conditions are new categories.
Sources
Last reviewed: 19 October 2026.
