The industry standard awareness document representing a broad consensus about the most critical security risks to modern web applications. Stay informed, stay secure.
Access control enforces policy such that users cannot act outside of their intended permissions. Failures lead to unauthorized information disclosure, data modification, or unauthorized operations. Examples include forced browsing, insecure direct object references, and bypassing access checks via URL tampering.
Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default settings, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.
Focuses on risks associated with the software supply chain, including the use of outdated or vulnerable third-party components, relying on untrusted registries, or insecure CI/CD pipelines. Attackers increasingly target dependencies to compromise a vast number of downstream applications.
Failures related to cryptography which often leads to sensitive data exposure. It includes the use of weak cryptographic algorithms, lack of encryption at rest or in transit, and improper key management.
Injection flaws, such as SQL, NoSQL, and command injection, occur when untrusted data is sent to an interpreter. Hostile data can trick the interpreter into executing unintended commands.
Represents "missing or ineffective control design." It emphasizes the need to adopt "shift-left" practices, focusing on threat modeling, secure design patterns, and architectures.
Vulnerabilities that allow attackers to compromise passwords, keys, or session tokens, or assume the identities of other users. Includes lack of MFA, weak password policies, and session fixation.
Relates to code and infrastructure that does not protect against integrity violations, like relying on plugins or modules from untrusted sources, or insecure CI/CD pipelines.
Without adequate logging and monitoring, breaches cannot be detected. Attackers rely on this failure to extract data, maintain access, and pivot to other systems undetected.
A new entry for 2025, focusing on how applications fail when facing unexpected states or errors. Attackers trigger edge cases causing the application to crash, bypass security, or leak data.