OWASP Top 10 2025 Released: Major Revisions and Two New Security Classes Added

The OWASP Top 10 2025 edition introduces two new security classes and shifts in risk rankings, including Software Supply Chain Failures at position A03 and Mishandling of Exceptional Conditions at position A10. Broken Access Control remains the top threat, with 3.73% of tested applications containing at least one of 40 CWEs in that category, while Security Misconfiguration climbs from fifth in 2021 to second in 2025, affecting 3.00% of applications across 16 CWEs.

The update analysed 589 CWEs across 248 categories, a substantial increase from about 400 in 2021, and combined data-driven analysis with community input using eight data-informed categories and two community-voted categories.

The project mapped roughly 175,000 CVE records to CWEs from the National Vulnerability Database and incorporated CVSS scores to assess risk severity, reflecting a broader focus on supply chain risk and proper error handling alongside persistent issues such as access controls and misconfigurations. The revised Top 10 aims to capture modern attack vectors and emerging threats across software dependencies, build systems, and distribution infrastructure.