Broken Access Control
Access control failures, including object-level authorization gaps and SSRF, allow actions outside intended permissions.
Versioned taxonomy
OWASP Web Top 10:2025
The current OWASP web application security taxonomy, preserved as a distinct edition.
Security Misconfiguration
Insecure defaults, unnecessary features, inconsistent hardening, and configuration drift expose systems.
Software Supply Chain Failures
Compromise or weakness across dependencies, build systems, distribution, and update channels.
Cryptographic Failures
Weak, missing, or incorrectly applied cryptography exposes sensitive data and trust boundaries.
Injection
Untrusted data is interpreted as code, queries, commands, expressions, or browser content.
Insecure Design
Missing or ineffective security controls originate in architecture, threat modeling, and business rules.
Authentication Failures
Identity proofing, credential, session, and account-recovery weaknesses enable impersonation.
Software or Data Integrity Failures
Software, updates, serialized data, and other artifacts cross trust boundaries without integrity verification.
Security Logging & Alerting Failures
Insufficient logging, monitoring, and alerting delays detection and response.
Mishandling of Exceptional Conditions
Fail-open behavior, improper error handling, and unexpected states undermine security controls.
Primary source and edition policy
Vulns.co preserves older editions at stable URLs and does not silently rewrite historical mappings.
Open the official OWASP edition ↗