OWASP was founded in 2001, and the OWASP Top Ten was first published in 2003. Later editions came in 2004, 2007, 2010, 2013, 2017, 2021 and 2025. Knowing which edition a document refers to matters, because the categories and their ranking change between editions.
The edition years
According to the Wikipedia article on OWASP, Mark Curphey started the project on 9 September 2001. The Top Ten editions are:
- 2003, the first
- 2004
- 2007
- 2010
- 2013
- 2017
- 2021
- 2025
The gaps are uneven. Early editions came a year apart, then the project moved to roughly three or four years between editions.
Why the edition matters
Compliance documents, contracts and questionnaires often say "OWASP Top 10" with no year. If a policy written in 2018 says to test against the Top 10, the team could reasonably mean the 2017 list, while a new auditor might read it as the 2025 list.
Pick one edition per document and name it. That small step avoids a lot of confusion.
An example of ranking change
SQL injection shows how a category can move. Wikipedia's SQL injection article says OWASP listed it among its top ten web application vulnerabilities in 2007 and 2010. In 2013 it was listed as the most critical. In 2017 it fell under the broader Injection category, which ranked third.
That is a change in how the list was organised as much as in the threat. A category can be merged into another one, so a missing name does not mean the problem went away.
How to use the list
The Top Ten is an awareness document, not a complete standard. Use it to:
- Train developers on common mistakes.
- Seed test cases for code review.
- Frame a conversation with non-security colleagues.
Do not use it as your only checklist. If you need coverage, pair it with a testing standard and your own threat model.
What this post cannot tell you
This article does not list the contents of each edition. If you need the exact category names for a given year, read that edition on the OWASP site and cite it directly.
Reading older reports
If you pick up a report that cites the Top Ten, check the date and then map categories by name, not by rank position. A category at number three in one edition might be split or merged in the next. When you compare your results across years, hold the edition constant, or note clearly that you changed it. Otherwise a drop in a category may only reflect the list changing. This is the same care you would take comparing financial figures under different accounting rules, and it prevents arguments that are really about definitions.
Quick check
When was the first OWASP Top Ten published?
2003, according to the source cited below.
Why should a policy name the edition?
Because categories and rankings change between editions, so an unversioned reference can be read in different ways.
Safeguard includes dependency scanning, and there is a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
