Two New Web Application Risk Categories Added to OWASP Top 10

OWASP has released a revised 2025 Top 10 list for web application risks, adding two new categories and reshuffling the order. The updated ranking keeps Broken Access Control in the lead, with server-side request forgery now incorporated into that category. Security Misconfiguration climbs to second place, ahead of Software Supply Chain Failures, which expands Vulnerable and Outdated Components to cover a broader ecosystem of software dependencies, build systems and distribution infrastructure.

New to the list is the Mishandling of Exceptional Conditions category, now in tenth place. The Cryptographic Failures, Injection (including XSS and SQL Injection), and Insecure Design categories each dropped two places, landing in fourth, fifth and sixth respectively, while Authentication Failures, Software or Data Integrity Failures, and Logging & Alerting Failures retain seventh, eighth and ninth.

According to OWASP, the changes are partly due to a different approach this year, including data from CWEs and CVEs to gauge exploitability and impact, though only eight categories were drawn from this data.