What are the 10 most common web security vulnerabilities?

15 October 2026 · By John Carlsson

The standard reference is the OWASP Top 10, and the current edition is 2025. In order, it lists Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.

Which edition is current

OWASP's Top 10 project page says the most current released version is the OWASP Top 10 2025. OWASP calls it a standard awareness document for developers and web application security, so it is a list of risk categories to learn from, not a checklist that proves a site is safe.

The OWASP Top 10:2025, with one practical step each

A01:2025 Broken Access Control: users acting outside their intended permissions. Except for public resources, deny access by default, and build access checks once and reuse them.
A02:2025 Security Misconfiguration: insecure settings in servers, apps or cloud services. Remove unused features and sample content, and send security headers.
A03:2025 Software Supply Chain Failures: flawed or malicious third-party code, tools or dependencies. Keep a record of every component you use and only obtain components from official sources over secure links.
A04:2025 Cryptographic Failures: weak or missing encryption and poorly managed keys. Work out which data is sensitive and protect that first.
A05:2025 Injection: untrusted input sent to an interpreter, from cross-site scripting to SQL injection. Use safe, parameterised interfaces and validate input on the server.
A06:2025 Insecure Design: security controls that were never planned. Use a secure development lifecycle and reuse proven secure design patterns.
A07:2025 Authentication Failures: weak logins and session handling. Turn on multi-factor authentication and reject common weak passwords.
A08:2025 Software or Data Integrity Failures: trusting code or data that has not been verified. Use digital signatures and only consume trusted repositories.
A09:2025 Security Logging and Alerting Failures: attacks that go unnoticed. Log security events, whether they succeed or fail, and make sure someone is alerted.
A10:2025 Mishandling of Exceptional Conditions: poor error handling and systems that fail open. Catch errors where they happen and add rate limits and quotas.

What changed from the 2021 list

Broken Access Control stays at number one, and server-side request forgery has been folded into it.
Security Misconfiguration moved up from fifth in 2021 to second in 2025.
Software Supply Chain Failures is an expansion of the 2021 category Vulnerable and Outdated Components.
Cryptographic Failures dropped from second to fourth, Injection from third to fifth and Insecure Design from fourth to sixth.
Authentication Failures stays at seventh with a slight name change, and the logging category was renamed to stress alerting.
Mishandling of Exceptional Conditions is a new category for 2025.

What this means for a small business website

If your site runs on a CMS with themes and plugins rather than custom code, the categories you can act on directly are usually A02, A03 and A07. Keep your CMS, themes and plugins updated and only install them from official sources. Use multi-factor authentication on admin accounts. Check that your server sends security headers and redirects all traffic to HTTPS.

The other categories mostly sit with whoever builds or hosts your site. It is reasonable to ask your developer or host how they handle access control, injection and error handling, and to point them to the OWASP pages linked above.

For the configuration side, our Security Audit offers a free and a paid security check. Its scoring was built to mirror Mozilla HTTP Observatory, then extended with DNS, SPF, DKIM, DMARC and known CVE checks.

Sources

Frequently asked questions

Is the OWASP Top 10 a security standard?

OWASP describes the Top 10 as a standard awareness document for developers and web application security. It names the most important categories of risk so teams know what to look for. It is not a full testing standard, and avoiding these ten categories does not prove a site is secure, so treat it as a starting point for your security work.

What is new in the OWASP Top 10 2025?

OWASP's introduction says Software Supply Chain Failures expands the 2021 category Vulnerable and Outdated Components, and Mishandling of Exceptional Conditions is a new category for 2025. Security Misconfiguration moved up from fifth to second, server-side request forgery was folded into Broken Access Control, and the logging category was renamed to stress alerting.