What Changed in OWASP Top 10 2025? Full Breakdown & Recommendations | Qualys

Summary: The OWASP Foundation released the eighth edition of its Top 10 Web Application Security Risks, its first major update since 2021, built on analysis of more than 175,000 CVE records and 589 Common Weakness Enumerations. Two new categories entered the list, Broken Access Control kept the top spot with expanded scope covering SSRF, BOLA and BFLA, and Software Supply Chain Failures entered at A03 with the highest average incidence rate of any category at 5.19%.
Key Takeaway: Software Supply Chain Failures carries a 5.19% incidence rate but only 11 CVEs map to its related CWEs, meaning attacks are landing in production while scanners lack the signatures to flag them. Security Misconfiguration showed 100% of tested applications with some form of misconfiguration, and the gap between intermittent scans and continuous deployment is an active exposure window.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026