Back to OWASP
Historical Archive

OWASP Top 10 Through the Years

From 2007 to 2025 — explore how web application security risks have evolved over nearly two decades. See which vulnerabilities persisted, which were added, and how the threat landscape shifted with new technologies.

The Evolution of #1 Risk

2007
XSS
2010
Injection
2013
Injection
2017
Injection
2021
Access Control
2025
Access Control

A01

Broken Access Control

API-first architectures, multi-tenant isolation, GraphQL authorization failures.

A02

Cryptographic Failures

Post-quantum preparedness, AI model encryption, secrets management in CI/CD.

A03

Injection

SQL/NoSQL + Prompt Injection targeting LLM-powered features.

A04

Insecure Design

Business logic abuse, AI model design flaws, missing threat modeling.

A05

Security Misconfiguration

Kubernetes, serverless, cloud storage misconfigs dominate.

A06

Vulnerable & Outdated Components

Supply chain attacks, typosquatting, XZ Utils-style backdoors.

A07

Identification & Authentication Failures

Passkey adoption issues, OAuth/OIDC misconfig, AI-enhanced credential stuffing.

A08

Software & Data Integrity Failures

CI/CD pipeline compromise, unsigned artifacts, SRI.

A09

Security Logging & Monitoring Failures

194-day average breach detection, log injection, missing SIEM.

A10

Server-Side Request Forgery (SSRF)

Cloud metadata attacks, Kubernetes service abuse, webhook SSRF.

Key Changes & Highlights

Prompt injection added to injection category
Post-quantum cryptography preparedness emphasized
Supply chain attacks (XZ Utils) drive component security focus
Cloud-native and Kubernetes misconfigurations prominent
View full detailed guide with code examples

Start with the Latest Version

The 2025 edition includes comprehensive code examples, real-world breach case studies, and actionable prevention strategies.