OWASP Top 10
The OWASP Top 10 is a periodically updated awareness document from the Open Worldwide Application Security Project that ranks the ten most critical web application security risks, such as broken access control, injection, and cryptographic failures, to guide developers and security teams.
The OWASP Top 10 is a consensus-driven list published by the Open Worldwide Application Security Project (OWASP) that identifies the most critical security risks facing web applications. Each edition groups real-world vulnerability classes into ten broad risk categories, for example A01 Broken Access Control, A03 Injection, and A02 Cryptographic Failures in the 2021 revision.
The list is assembled from aggregated vulnerability data contributed by many organizations, combined with an industry survey to capture emerging risks that data alone may lag on. Categories are ranked using factors such as prevalence, exploitability, detectability, and business impact, then mapped to underlying CWE weaknesses so teams can trace a category down to concrete coding flaws.
For developers, the OWASP Top 10 is a practical baseline for secure development, threat modeling, training, and compliance conversations. Many security tools and code scanners categorize their findings against it, which makes it a common shared vocabulary between engineering and security teams even though it is an awareness resource rather than an exhaustive standard.