OWASP Top 10 (2025)
OWASP Top 10. Mapped to Deva detection.
The OWASP Top 10 is the standard awareness document for web application security. The 2025 edition is the current released version. Major changes from 2021: Software Supply Chain Failures elevated to A03, Security Misconfiguration to A02, SSRF dropped off the list (consolidated under A01 Broken Access Control), and Mishandling of Exceptional Conditions is the new entrant at A10. Each category below links to the underlying CWE detection guides Deva ships, real-world breaches that fell into the category, and the compliance frameworks that explicitly require coverage.
Broken Access Control
Authorization that fails to enforce who can do what.
Security Misconfiguration
Insecure defaults, unnecessary features, or misapplied permissions left in production.
Software Supply Chain Failures
Breakdowns or malicious changes in the process of building, distributing, or updating software.
Read the A03 guideCryptographic Failures
Sensitive data exposed because cryptography is missing, weak, or misused.
Injection
Untrusted input interpreted as code or commands by a downstream interpreter.
Insecure Design
Architectural decisions that create vulnerabilities no amount of clean implementation can fix.
Authentication Failures
Weak, missing, or improperly implemented authentication.
Software or Data Integrity Failures
Code or data accepted from untrusted sources without integrity verification.
Security Logging and Alerting Failures
Attacks succeed undetected because the application does not log enough, or no alert is raised when something is logged.
Read the A09 guideMishandling of Exceptional Conditions
Programs that fail to prevent, detect, and respond to unusual situations, leading to crashes, unexpected behavior, and vulnerabilities.
Read the A10 guideWhat changed in 2025: The published OWASP Top 10:2025 differs in important ways from the public-review draft. SSRF (A10:2021) dropped off the list entirely (its CWE-918 is now consolidated under A01 Broken Access Control). The new A10 is Mishandling of Exceptional Conditions, replacing the LLM category that some drafts speculated about. Software Supply Chain Failures (formerly A06:2021 Vulnerable Components) was renamed, expanded in scope, and elevated to A03. Security Misconfiguration moved to A02. Authentication Failures keeps A07 with a shorter name.
Citation note: OWASP Top 10 category descriptions and rankings are maintained by the OWASP Foundation under Creative Commons licensing. Sourced from owasp.org/Top10/2025. The breach summaries and Deva-specific detection details on each category page are written by the Deva Security Team. Every category has its own page, for example /owasp/a01-broken-access-control.