OWASP Top 10 Vulnerabilities
The OWASP Top 10 web application security risks.
The OWASP Top 10 web application security risks as ranked in the 2021 edition, from broken access control to server-side request forgery, each with a one-line description of what goes wrong. It is the standard shorthand for the most common classes of web vulnerability.
Use it when
- You are scoping a security review or training developers on common failure classes.
- You need the official category names and their order in the 2021 list.
Watch out for
- This is the 2021 edition. OWASP revises the list periodically, so check owasp.org for the current version before citing a rank.
- A category is a class of weakness, not a single bug; the same application can have several instances of one category.
The data
10 rows
| Rank | Name | Description |
|---|---|---|
| A01 | Broken Access Control | Restrictions on authenticated users are not properly enforced. |
| A02 | Cryptographic Failures | Failures related to cryptography that expose sensitive data. |
| A03 | Injection | Untrusted data is sent to an interpreter as part of a command or query. |
| A04 | Insecure Design | Missing or ineffective security design controls. |
| A05 | Security Misconfiguration | Insecure default configurations or incomplete ad-hoc configurations. |
| A06 | Vulnerable and Outdated Components | Using components with known vulnerabilities. |
| A07 | Identification and Authentication Failures | Weaknesses in identity and session management. |
| A08 | Software and Data Integrity Failures | Assuming untrusted updates and data are valid. |
| A09 | Security Logging and Monitoring Failures | Insufficient logging and monitoring to detect and respond to attacks. |
| A10 | Server-Side Request Forgery | Forcing the server to make requests to unintended locations. |
Fields
The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.
| Section | Field | Type | Example |
|---|---|---|---|
| data | rank | string | A01 |
| data | name | string | Broken Access Control |
| data | description | string | Restrictions on authenticated users are not pro… |
Fetch the same bytes
The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.
curl "https://yjtoon.yunusemrevurgun.com/api/dataset/common-vulnerabilities-owasp?format=toon"
const res = await fetch( "https://yjtoon.yunusemrevurgun.com/static-data/dataset/common-vulnerabilities-owasp.toon" ); const toon = await res.text();
Rate limit: 120 requests per minute per IP, no key and no signup. API reference →