OWASP Highlights Supply Chain Risks in New Top 10

OWASP has updated its Top 10 software vulnerabilities, emphasising supply chain risks and systemic design weaknesses rather than just coding errors. The Nov. 6 release marks OWASP’s first major Top 10 update since 2021 and places greater focus on supply chain issues, with the category “Software Supply Chain Failures” ranked third on the list. The update notes that the list is based on data related to about 220,000 CVEs mapped to 589 CWEs, compared with 400 CWEs in 2021.

Security misconfiguration surged to the second spot from fifth, with OWASP noting that 3 percent of nearly 2.8 million applications analysed had at least one of 16 common CWEs in this category. Mishandling of exceptional conditions was ranked tenth, reflecting concerns around error handling and related conditions, while Cryptographic Failures, Injection, and Insecure Design moved lower than in 2021.

OWASP also highlights that breaches often stem from weaknesses across the software lifecycle, including development pipelines and supply chain dependencies, not solely from individual bugs.