OWASP Top 10 guides for Web, Mobile, API, and LLM | STH
Explore the current OWASP Top 10 editions by technology area. Each guide has ten linkable risk sections, original high-level testing guidance, an educational diagram, and a link to the official OWASP source.
OWASP Top 10:2025 for web applications · A01:2025
Broken Access Control
Authorization rules do not consistently enforce what an authenticated user may view, change, approve, or administer.
OWASP Top 10:2025 for web applications · A02:2025
Security Misconfiguration
Unsafe defaults, unnecessary features, permissive cloud settings, or missing hardening leave systems exposed.
OWASP Top 10:2025 for web applications · A03:2025
Software Supply Chain Failures
Third-party packages, build systems, update channels, and dependencies are not governed well enough to preserve integrity.
OWASP Top 10:2025 for web applications · A04:2025
Cryptographic Failures
Sensitive data is exposed because encryption, key management, protocol choices, or data classification are inadequate.
OWASP Top 10:2025 for web applications · A05:2025
Injection
Untrusted input is interpreted as a command, query, template, or expression by a downstream component.
OWASP Top 10:2025 for web applications · A06:2025
Insecure Design
The product design lacks security requirements, misuse cases, or controls needed for the business workflow it supports.
OWASP Top 10:2025 for web applications · A07:2025
Authentication Failures
Identity proofing, session handling, recovery, or credential defenses do not reliably establish and maintain the right user identity.
OWASP Top 10:2025 for web applications · A08:2025
Software or Data Integrity Failures
Applications trust code, updates, serialized objects, or data from an integrity boundary that has not been verified.
OWASP Top 10:2025 for web applications · A09:2025
Security Logging & Alerting Failures
Important security events are not recorded, protected, correlated, or acted on in time.
OWASP Top 10:2025 for web applications · A10:2025
Mishandling of Exceptional Conditions
Failures, timeouts, overload, and unexpected states are handled inconsistently or fail open.
OWASP Mobile Top 10:2024 · M1
Improper Credential Usage
Secrets, tokens, API keys, or passwords are embedded, reused, exposed, or handled without an appropriate lifecycle.
OWASP Mobile Top 10:2024 · M2
Inadequate Supply Chain Security
Mobile SDKs, build plugins, signing systems, and distribution dependencies are not sufficiently governed.
OWASP Mobile Top 10:2024 · M3
Insecure Authentication/Authorization
The app or its backend accepts weak identity proof, session handling, or permission decisions.
OWASP Mobile Top 10:2024 · M4
Insufficient Input/Output Validation
Data crossing application, device, backend, browser, or third-party boundaries is trusted without sufficient checks.
OWASP Mobile Top 10:2024 · M5
Insecure Communication
Network traffic, certificate handling, or channel selection does not adequately protect data in transit.
OWASP Mobile Top 10:2024 · M6
Inadequate Privacy Controls
The app collects, shares, retains, or exposes personal data beyond the disclosed and necessary purpose.
OWASP Mobile Top 10:2024 · M7
Insufficient Binary Protections
The distributed app does not sufficiently resist unauthorized modification, repackaging, or analysis for its threat model.
OWASP Mobile Top 10:2024 · M8
Security Misconfiguration
Build variants, platform settings, exported components, or backend configuration expose unintended behavior.
OWASP Mobile Top 10:2024 · M9
Insecure Data Storage
Sensitive data is stored locally or cached where another application, backup, device user, or forensic process can access it.
OWASP Mobile Top 10:2024 · M10
Insufficient Cryptography
Cryptographic algorithms, modes, random values, keys, or implementations do not protect mobile data as intended.
OWASP API Security Top 10:2023 · API1:2023
Broken Object Level Authorization
An API accepts an object identifier without confirming that the caller is allowed to access that specific object.
OWASP API Security Top 10:2023 · API2:2023
Broken Authentication
API identity, token, session, credential, or recovery mechanisms can be bypassed, replayed, or abused.
OWASP API Security Top 10:2023 · API3:2023
Broken Object Property Level Authorization
An API exposes or accepts properties that the caller should not be able to read or modify.
OWASP API Security Top 10:2023 · API4:2023
Unrestricted Resource Consumption
Requests can consume excessive compute, memory, storage, network capacity, or paid downstream services.
OWASP API Security Top 10:2023 · API5:2023
Broken Function Level Authorization
An API endpoint or action is reachable by a caller whose role should not perform that function.
OWASP API Security Top 10:2023 · API6:2023
Unrestricted Access to Sensitive Business Flows
An API permits automation or repetition of a legitimate high-value business flow without enough abuse resistance.
OWASP API Security Top 10:2023 · API7:2023
Server Side Request Forgery
A server fetches a caller-controlled URL or network destination without enough destination controls.
OWASP API Security Top 10:2023 · API8:2023
Security Misconfiguration
API gateways, CORS, headers, cloud resources, error handling, or defaults expose more than intended.
OWASP API Security Top 10:2023 · API9:2023
Improper Inventory Management
Teams do not know all API hosts, versions, environments, owners, and exposed data flows.
OWASP API Security Top 10:2023 · API10:2023
Unsafe Consumption of APIs
An application trusts data, availability, authentication, or behavior from an upstream API more than it should.
OWASP Top 10 for LLM Applications:2025 · LLM01:2025
Prompt Injection
Untrusted content influences a model to disregard intended instructions, reveal information, or take an unsafe path.
OWASP Top 10 for LLM Applications:2025 · LLM02:2025
Sensitive Information Disclosure
An LLM application exposes secrets, personal data, confidential context, or protected output to an unauthorized audience.
OWASP Top 10 for LLM Applications:2025 · LLM03:2025
Supply Chain
Models, datasets, plugins, agents, frameworks, and hosted services introduce dependencies that are not adequately trusted or governed.
OWASP Top 10 for LLM Applications:2025 · LLM04:2025
Data and Model Poisoning
Training, fine-tuning, evaluation, or retrieval data is manipulated to degrade quality, bias outcomes, or create unwanted behavior.
OWASP Top 10 for LLM Applications:2025 · LLM05:2025
Improper Output Handling
Downstream systems trust or render model output without validation, encoding, or policy checks.
OWASP Top 10 for LLM Applications:2025 · LLM06:2025
Excessive Agency
An LLM agent has more tools, permissions, autonomy, or action scope than the task requires.
OWASP Top 10 for LLM Applications:2025 · LLM07:2025
System Prompt Leakage
System prompts or hidden instructions are disclosed and may reveal confidential logic, data, or operational assumptions.
OWASP Top 10 for LLM Applications:2025 · LLM08:2025
Vector and Embedding Weaknesses
Vector stores and retrieval pipelines lack appropriate access control, tenant separation, data governance, or integrity controls.
OWASP Top 10 for LLM Applications:2025 · LLM09:2025
Misinformation
An LLM produces plausible but false, incomplete, outdated, or poorly sourced information that users rely on.
OWASP Top 10 for LLM Applications:2025 · LLM10:2025
Unbounded Consumption
An LLM application permits uncontrolled token, compute, tool, storage, or external-service consumption.Choose an OWASP guide by scope
-
OWASP 2025
OWASP Top 10:2025 for web applications
A practical guide to the ten risk categories in the current OWASP Top 10:2025. Use it to scope web application testing, align remediation work, and link findings to the official OWASP taxonomy.
-
OWASP 2024
OWASP Mobile Top 10:2024
A guide to the ten current OWASP Mobile Top 10:2024 categories for Android, iOS, and the services they depend on.
-
OWASP 2023
OWASP API Security Top 10:2023
A guide to the current stable OWASP API Security Top 10:2023 categories for APIs, integrations, and service-to-service boundaries.
-
OWASP 2025
OWASP Top 10 for LLM Applications:2025
A guide to the current OWASP Top 10 for LLM Applications:2025, covering model-facing inputs, data, tool use, supply chains, and operational safeguards.