Every current OWASP Top 10 list, with examples and mitigations for exam prep
The original and best-known OWASP list: the ten broadest categories of security risk in web applications. It is an awareness document rather than a checklist, and it is the single most widely referenced application-security framework in certification exams.
The 2025 edition replaced the long-running 2021 edition. Many certification exams still test the 2021 list, so both are shown on this page.
Retained for reference because many certification exams and internal standards still reference the 2021 categories.
APIs fail differently from rendered web applications. They expose object identifiers and object properties directly, they are consumed by clients the server does not control, and their business logic is reachable without a browser. This list focuses on the authorization and resource-consumption problems that dominate API breaches.
Mobile applications run on hardware the attacker may fully control, which changes the threat model: binaries can be inspected and patched, local storage can be read, and traffic can be intercepted with a device-installed certificate. This list covers the risks that follow from shipping code to an untrusted endpoint.
The 2024 edition is a substantial renumbering of the older 2016 list. If your exam materials reference M1 Improper Platform Usage or M2 Insecure Data Storage, they are using the 2016 edition.
The reference risk list for applications built on large language models, published by the OWASP Gen AI Security Project. It covers failure modes that traditional application-security frameworks do not describe, because the vulnerable component is a probabilistic model that cannot reliably distinguish instructions from data.
The project was originally the OWASP Top 10 for Large Language Model Applications and is now published under the renamed OWASP Gen AI Security Project. The identifiers below are the 2025 edition, which is the edition listed on the project's own Top 10 page. OWASP announced a 2026 edition in August 2026; at the time of writing its full category list is distributed as a gated download and is not yet reflected on the project's public list page, so it is not reproduced here.
The companion list to the LLM Top 10, covering systems where a model is an actor rather than a text generator: it holds goals, credentials, memory, and tools, and chains actions over many steps. The risks here are about autonomy and identity rather than about generation quality.
Released by the OWASP Gen AI Security Project in December 2025 as the 2026 edition. Identifiers and titles below follow the project's own announcement.
Build and delivery systems are high-value targets: they hold credentials for every environment, they execute code by design, and their output is trusted and deployed automatically. This list catalogues the ways an attacker moves from access to a repository or pipeline into production.
The risk identifiers and category titles on this page are published by the OWASP Foundation and its project teams. All explanations, examples, and mitigation guidance are original material written by CyberCertPrep and are not OWASP text. OWASP project content is licensed under CC BY-SA 4.0. CyberCertPrep is not affiliated with or endorsed by the OWASP Foundation. Always check the official project pages below for the authoritative current edition.