What is OWASP Top 10?

The OWASP Top 10 is a widely used list of the ten most critical security risks to web applications, published by the Open Worldwide Application Security Project.

The 2025 edition is led by Broken Access Control, Security Misconfiguration and the new Software Supply Chain Failures category, and adds Mishandling of Exceptional Conditions at number ten.

Security questionnaires, penetration-test reports and standards such as PCI DSS commonly reference it as the baseline a web application should be tested against.