OWASP Top 10
Compare official OWASP Top 10 releases, inspect issue rankings over time, and explore security risk evolution.
Official OWASP list| Rank | Category | Summary | Details |
|---|---|---|---|
| 01 |
| A1 Injection covers Injection, Cross-Site Scripting (XSS). |
| Details |
| 02 | Cross-Site Scripting (XSS) | A2 Cross-Site Scripting (XSS) covers Cross-Site Scripting (XSS), Injection. | Details |
| 03 | Broken Authentication and Session Management | A3 Broken Authentication and Session Management covers Authentication Failures, Session Management. | Details |
| 04 | Insecure Direct Object References | A4 Insecure Direct Object References covers Insecure Direct Object Reference (IDOR), Broken Access Control. | Details |
| 05 | Cross-Site Request Forgery (CSRF) | A5 Cross-Site Request Forgery (CSRF) covers Cross-Site Request Forgery (CSRF). | Details |
| 06 | Security Misconfiguration | A6 Security Misconfiguration covers Security Misconfiguration. | Details |
| 07 | Insecure Cryptographic Storage | A7 Insecure Cryptographic Storage covers Cryptographic Failures, Sensitive Data Exposure. | Details |
| 08 | Failure to Restrict URL Access | A8 Failure to Restrict URL Access covers Broken Access Control. | Details |
| 09 | Insufficient Transport Layer Protection | A9 Insufficient Transport Layer Protection covers Transport Layer Protection, Cryptographic Failures. | Details |
| 10 | Unvalidated Redirects and Forwards | A10 Unvalidated Redirects and Forwards covers Unvalidated Redirects and Forwards, Input Validation. | Details |
