OWASP Top 11

The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.

About OWASP Top 11

Translation Efforts

Efforts have been made in numerous languages to translate the OWASP Top 10 - 2025. If you are interested in helping, please contact the members of the team for the language you are interested in contributing to, or if you don’t see your language listed (neither here nor at github), please email [email protected] to let us know that you want to help and we’ll form a volunteer group for your language.

• https://github.com/OWASP/Top10/issues?utf8=%E2%9C%93&q=is%3Aissue

• https://owasp.org/cdn-cgi/l/email-protection

Top10:2025 Completed Translations:

Translations in progress - check back soon!

Project Resources

• Stay Tuned!

• Community Survey

• A01:2021-Broken Access Control

• A02:2021-Cryptographic Failures

• A03:2021-Injection

• A04:2021-Insecure Design

• A05:2021-Security Misconfiguration

• A06:2021-Vulnerable and Outdated Components

• A07:2021-Identification and Authentication Failures

• A08:2021-Software and Data Integrity Failures

• A09:2021-Security Logging and Monitoring Failures

• A10:2021-Server-Side Request Forgery

Project Leaders

Andrew van der Stock

Project Leader

Brian Glas

Project Leader

Neil Smithline

Project Leader

Torsten Gigler

Project Leader

Downloads or Social Links

• OWASP Top 10 2017

• Other languages → tab Translation Efforts

• Twitter

• GitHub Repository

Project Information

Language

Documentation

License

Creative Commons Attribution-ShareAlike v4.0

Latest Version

2021 (2025 coming soon)

Contributors

Requirements

Web application development knowledge
Basic security awareness
Understanding of common vulnerabilities
Application security testing tools
Development team training

Corporate Supporters

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.