OWASP Top 10

Name: OWASP Top 10
Creator: staticdata.dev
License: https://spdx.org/licenses/CC-BY-3.0.html

The OWASP Top 10 is the widely used consensus list of the ten most critical security risks to web applications, published by the OWASP Foundation. This dataset contains the 2021 edition, whose ranking drew on vulnerability data from over 500,000 tested applications plus a community survey. (A 2025 edition has since been published; see below.) Each entry carries a ranked position, a canonical identifier (e.g. A01:2021), a short name, and a detailed description of the risk.

v1.0.0 CC-BY-3.0 10 records Updated 2026-10-05 stable Source: OWASP Top 10 2021

Quick fetch

Stable URL. CORS-enabled. No auth.

bash

curl https://staticdata.dev/v1/owasp-top-10.json

Or use as a typed import: import { owaspTop10 } from "https://staticdata.dev/v1/owasp-top-10.ts"

Formats

JSON 3.9 KB

/v1/owasp-top-10.json

Open

min: 3.6 KB · /v1/owasp-top-10.min.json
CSV 3.2 KB

/v1/owasp-top-10.csv

Open
TypeScript 4.1 KB

/v1/owasp-top-10.ts

export const owaspTop10

type OwaspRisk = (typeof owaspTop10)[number]

Open

Schema

Each record in the dataset has the following shape.

Schema
Field	Type	Description	Example
rank	number	Ordinal rank from 1 (most critical) to 10	1
id	string	Canonical OWASP identifier (e.g. A01:2021)	A01:2021
name	string	Short name of the risk category	Broken Access Control
description	string	Explanation of the risk and its impact	Restrictions on what authenticated users are allowed to do are not properly enforced.

Preview

First 10 records.

Data preview
rank	id	name	description
1	A01:2021	Broken Access Control	Restrictions on what authenticated users are allowed to do are not properly enforced. Attackers can exploit these flaws to access unauthorized functionality or data, such as accessing other users' accounts, viewing sensitive files, modifying other users' data, or changing access rights.
2	A02:2021	Cryptographic Failures	Failures related to cryptography (or lack thereof) that often lead to exposure of sensitive data. This includes use of weak algorithms, improper key management, transmitting data in cleartext, and failing to enforce HTTPS or other encryption for sensitive data in transit or at rest.
3	A03:2021	Injection	User-supplied data is not validated, filtered, or sanitized by the application, allowing hostile data to be sent to an interpreter. SQL, NoSQL, OS, LDAP, and other injection attacks occur when untrusted data is sent to an interpreter as part of a command or query.
4	A04:2021	Insecure Design	Missing or ineffective control design representing weaknesses in the architecture and design of an application. Insecure design differs from insecure implementation; a securely implemented insecure design cannot be fixed by a perfect implementation.
5	A05:2021	Security Misconfiguration	The application is missing appropriate security hardening, has improper permissions, unnecessary features are enabled, default accounts and passwords remain unchanged, error handling reveals overly informative stack traces, or the latest security features are not configured.
6	A06:2021	Vulnerable and Outdated Components	Components such as libraries, frameworks, and software modules run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine defenses.
7	A07:2021	Identification and Authentication Failures	Confirmation of the user's identity, authentication, and session management are critical to protect against authentication-related attacks. Failures include permitting automated attacks like credential stuffing, allowing weak passwords, missing multi-factor authentication, and improper session management.
8	A08:2021	Software and Data Integrity Failures	Code and infrastructure that does not protect against integrity violations. Applications relying on plugins, libraries, or modules from untrusted sources, repositories, and CDNs, or CI/CD pipelines without integrity verification are vulnerable to unauthorized modification of software or data.
9	A09:2021	Security Logging and Monitoring Failures	Insufficient logging, detection, monitoring, and active response allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show detection time exceeds 200 days, typically by external parties rather than internal processes.
10	A10:2021	Server-Side Request Forgery	SSRF flaws occur whenever a web application fetches a remote resource without validating the user-supplied URL. An attacker can coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list.

Showing 10 of 10. View full data: JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl

curl -sSL https://staticdata.dev/v1/owasp-top-10.json | jq '.[0]'

JavaScript

import type { OwaspRisk } from "https://staticdata.dev/v1/owasp-top-10.ts";

const res = await fetch("https://staticdata.dev/v1/owasp-top-10.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const owaspTop10: OwaspRisk[] = await res.json();
console.log(owaspTop10[0]);

Python

import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/owasp-top-10.min.json") as r:
    owaspTop10 = json.load(r)

print(owaspTop10[0])

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/owasp-top-10.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}

Rust

use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/owasp-top-10.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The OWASP Top 10 2021 is maintained by the Open Web Application Security Project, a nonprofit foundation dedicated to improving software security. The list is revised periodically based on real-world vulnerability data contributed by organizations worldwide; the 2021 edition drew on vulnerability data covering over 500,000 applications contributed by testing organisations, combined with a community survey for two of the categories. Three new categories were introduced in 2021 — Insecure Design (A04), Software and Data Integrity Failures (A08), and Server-Side Request Forgery (A10) — while several previously separate categories were merged.

Each record in this dataset corresponds to one of the ten ranked risk categories. The id field uses the canonical OWASP format AXX:YYYY, where XX is the two-digit rank and YYYY is the edition year. Descriptions are based on the official OWASP Top 10 documentation and summarize the nature, root cause, and potential impact of each risk category.

This dataset covers only the Top 10 risks from the 2021 edition. As of October 2026 the current edition is the OWASP Top 10:2025 (A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, A10 Mishandling of Exceptional Conditions; SSRF is folded into Broken Access Control). The 2021 records are kept unchanged so that the A0X:2021 identifiers stay stable for existing consumers; the 2025 list is at https://owasp.org/Top10/2025/. It does not enumerate individual CWEs mapped to each category (which OWASP provides separately), nor does it include the full testing guidance or prevention checklists found in the OWASP documentation. For deeper detail, consult the official OWASP Top 10 site at https://owasp.org/Top10/.

The OWASP Top 10 is © the OWASP Top 10 Team and licensed under the Creative Commons Attribution 3.0 Unported License (CC BY 3.0); the names and descriptions in this dataset are derived from it, so reuse requires attribution to the OWASP Foundation.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the owasp-top-10 changelog for this dataset's history.