OWASP vulnerabilities in 2026: the current Top 10 explained

The OWASP vulnerabilities your team tests against in 2026 have changed. The current edition adds two categories, merges one, and moves Software Supply Chain Failures to third place. If your checklist still says “Vulnerable and Outdated Components,” you’re testing against an old list.

This guide covers the current OWASP vulnerabilities, what moved, and how to find each risk in your web application security program. Each risk includes the fix OWASP recommends.

What are OWASP vulnerabilities?

OWASP vulnerabilities are the weakness categories ranked in the OWASP Top 10, an awareness document from the Open Worldwide Application Security Project (OWASP). Developers, auditors, and cybersecurity buyers all use it as a baseline for application security.

The current edition, published as OWASP Top 10:2025, is the eighth installment. OWASP analyzed data on more than 2.8 million applications and 589 Common Weakness Enumerations (CWEs), then grouped them by root cause. Eight of the 10 categories come from that data. Two come from a community survey of practitioners.

The survey exists because testing data looks backward. Software Supply Chain Failures is the clearest example of a risk that attackers used long before scanners could detect it.

The OWASP Top 10 vulnerabilities for 2026

OWASP labels this list 2025, the year it was published, and it’s the one to test against in 2026. Here’s the current list, with a plain meaning for each risk:

• A01:2025 Broken Access Control: users act outside their permissions, which leads to unauthorized access to data or functions.
• A02:2025 Security Misconfiguration: insecure defaults, open cloud permissions, or missing hardening expose systems.
• A03:2025 Software Supply Chain Failures: compromised or unmaintained dependencies, build systems, and distribution infrastructure.
• A04:2025 Cryptographic Failures: weak or missing encryption exposes sensitive data.
• A05:2025 Injection: untrusted input runs as a command inside an interpreter.
• A06:2025 Insecure Design: flaws in the design itself, such as missing threat modeling, that no later code fix fully repairs.
• A07:2025 Authentication Failures: attackers pass as legitimate users.
• A08:2025 Software or Data Integrity Failures: code, updates, or data are trusted without verification.
• A09:2025 Security Logging and Alerting Failures: attacks go unnoticed because nobody logs the events or acts on the alerts.
• A10:2025 Mishandling of Exceptional Conditions: errors and abnormal states leave an application in an unsafe state.

What’s new in the current list

OWASP announced the release candidate on November 6, 2025, and the final list is now live. Three changes stand out.

Software Supply Chain Failures is new. It expands the old Vulnerable and Outdated Components category to cover build systems and distribution infrastructure, not only libraries with known vulnerabilities. Mishandling of Exceptional Conditions is also new. Server-Side Request Forgery (SSRF), once a category of its own, now sits inside Broken Access Control.

Security Misconfiguration jumped from fifth to second, while Cryptographic Failures and Injection each fell two places. Two names changed too. Authentication Failures replaces Identification and Authentication Failures, and Security Logging and Alerting Failures replaces the “Monitoring” version. OWASP made the second change because logs nobody acts on stop nothing.

The current OWASP vulnerabilities in detail

Broken access control and security misconfiguration (A01, A02)

Broken Access Control still ranks first. OWASP’s data shows 3.74 percent of tested applications had at least one of its 40 CWEs, and the category now absorbs SSRF. Typical flaws include insecure direct object references, where changing an ID in a URL returns another user’s record. Another is application programming interfaces (APIs) that skip permission checks on POST, PUT, and DELETE requests. Attackers gain unauthorized access without breaking any encryption.

Fix it on the server. Deny by default, write access control once and reuse it, enforce record ownership, and keep JSON Web Token lifetimes short.

Security Misconfiguration climbed to second because more application behavior now lives in configuration. Default credentials, verbose stack traces, and open cloud storage permissions are the usual causes. Automate hardening so development, QA, and production match. Replace static keys with short-lived credentials.

Software supply chain failures (A03)

This category earned its spot by community vote. Exactly half of survey respondents ranked it first. It has the fewest occurrences in OWASP’s data but the highest average exploit and impact scores from related Common Vulnerabilities and Exposures (CVEs). OWASP says testing hasn’t caught up, so the data likely understates the risk.

The Shai-Hulud npm worm shows why. In September 2025, the Cybersecurity and Infrastructure Security Agency (CISA) reported that it had compromised more than 500 packages. The malware stole GitHub tokens and cloud keys, then used stolen npm credentials to publish infected versions of other packages. Developer machines were the target, not production servers.

OWASP’s prevention advice starts with a software bill of materials (SBOM). Generate one centrally, track transitive dependencies, remove unused ones, pull components only from trusted sources, and watch for unmaintained libraries.

Mend SCA automates that work. It maps direct and transitive dependencies, detects malicious packages, enforces policy, and prioritizes exploitable vulnerabilities by reachability. It also generates SBOMs in SPDX and CycloneDX formats. Mend Renovate then opens pull requests to update outdated dependencies.

Cryptographic failures and injection (A04, A05)

Cryptographic Failures covers weak algorithms, leaked keys, hard-coded secrets, and missing Transport Layer Security (TLS). The result is exposed sensitive data such as passwords, payment details, and health records. OWASP found the category in 3.80 percent of tested applications. Store passwords with an adaptive hash such as Argon2, drop MD5 and SHA-1, and encrypt data in transit with TLS 1.2 or later.

Injection fell to fifth but still produced the most CVEs of any category, more than 62,000 across 37 CWEs. Cross-site scripting is frequent and lower in impact. SQL injection is rarer and more damaging. In OWASP’s example, the input ' OR '1'='1 turns a single-record lookup into a query that returns every row.

The fix is to keep data away from commands. Use parameterized queries and positive server-side validation. Static application security testing (SAST) catches these flaws as developers write code. Mend SAST delivers 38 percent better precision and 48 percent better recall than benchmark competitors, so developers see fewer false alarms.

Insecure design and authentication failures (A06, A07)

Insecure Design slid to sixth as two categories moved past it, though OWASP also notes better threat modeling across the industry. No scanner patches a design flaw after the fact, so threat model before you write code and test misuse cases beside the happy path.

Authentication Failures holds seventh place with 36 CWEs. Older editions called it Broken Authentication. Credential stuffing remains the main attack, and hybrid password spraying makes it harder to spot: attackers change “Winter2025” to “Winter2026” and try again.

Require multi-factor authentication, check new passwords against breached lists, and limit failed logins. Align password policy with National Institute of Standards and Technology (NIST) SP 800-63B, which advises against routine forced rotation.

Integrity failures, logging, and exceptional conditions (A08 to A10)

Software or Data Integrity Failures covers code and data trusted without verification. Insecure deserialization lives here. In OWASP’s example, a React app passes serialized Java user state back and forth. An attacker spots the “rO0” pattern that marks a serialized Java object and gains remote code execution. Sign your updates and artifacts, and never accept unsigned serialized data from clients.

Logging and alerting failures let attacks go unnoticed. Log authentication and access control failures with context, then alert someone who can act.

Mishandling of Exceptional Conditions debuts at tenth with 24 CWEs. The category covers improper error handling, logic errors, and failing open. OWASP’s example is a multi-step transaction that debits one account, credits another, then logs the result. If an error hits midway and nothing rolls back, an attacker can drain the account or trigger duplicate transfers. Fail closed: catch errors where they occur, roll back the whole transaction, and keep a global exception handler as a backstop.

How to test for OWASP vulnerabilities

No single tool covers all 10 categories, so security testing works in layers. SAST finds injection, hard-coded secrets, and error-handling flaws in source code. Software composition analysis (SCA) covers A03 and the known vulnerabilities inside your dependencies. Dynamic application security testing (DAST) probes running applications for access control and misconfiguration problems, the way an attacker sees them. OWASP itself recommends adding SAST, DAST, and interactive testing to the continuous integration and continuous delivery (CI/CD) pipeline to catch injection before production.

Run all three on every pull request where you can, then fix by exploitability and reachability instead of raw finding count. For more depth, read our guides to security testing and application security testing.

Mend AppSec covers SAST, SCA, and container scanning. DAST extends testing to running applications.

Other OWASP Top 10 lists

OWASP maintains separate lists for other attack surfaces. The OWASP Top 10 for large language model (LLM) applications has a 2026 edition. It keeps prompt injection at number one and renames system prompt leakage to hidden context exposure. The OWASP API Security Top 10 covers broken object-level authorization and excessive data exposure. The OWASP Top 10 open source software risks list covers risks such as known vulnerabilities, compromised legitimate packages, and unmaintained software. OWASP also lists mobile and cloud-native risks.

FAQs

Find OWASP vulnerabilities before attackers do

See how Mend AppSec scans your code and dependencies for the risks on the OWASP list. Join the teams reducing remediation effort by 75 percent.