OWASP Top 10 2021

Restrictions on authenticated users are not properly enforced, allowing attackers to access unauthorized data or functions.

Failures related to cryptography that lead to exposure of sensitive data or system compromise.

Untrusted data is sent to an interpreter as part of a command or query, allowing attackers to execute unintended commands.

Missing or ineffective security controls and architectural flaws that cannot be fixed by perfect implementation alone.

Missing security hardening, default configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages.

Using components with known vulnerabilities, including libraries, frameworks, and other software modules.

Weaknesses in authentication mechanisms that allow attackers to compromise passwords, keys, session tokens, or exploit implementation flaws.

Code and infrastructure that does not protect against integrity violations — insecure CI/CD pipelines, auto-updates without verification, and untrusted deserialization.

Insufficient logging, detection, monitoring, and active response that allows attackers to persist undetected.

The application fetches a remote resource without validating the user-supplied URL, allowing attackers to access internal services.