OWASP Top 10 and CWE Reference

Security conversations lean on two reference systems. The Open Worldwide Application Security Project, OWASP, publishes short ranked lists of the most critical risks, easy to remember and quote. MITRE maintains the Common Weakness Enumeration, a numbered catalogue of the specific kinds of software weakness. Reports, scanners, training courses and job interviews mix both, and a developer who can move between them understands what a finding means. This page puts three OWASP lists and a CWE table in one searchable place, written in plain language.

The three lists

The OWASP Top 10 for web applications, in its 2021 edition, ranks broad risk categories: A01 Broken Access Control comes first, followed by cryptographic failures, injection, insecure design, security misconfiguration, outdated components, authentication failures, integrity failures, logging failures and server-side request forgery. The API Security Top 10 from 2023 narrows to the risks of programming interfaces, such as broken object level authorization and unrestricted resource consumption. The Top 10 for LLM applications from 2025 covers systems built on large language models, from prompt injection to excessive agency. Each list has its own codes: A01 to A10, API1 to API10 and LLM01 to LLM10.

How the reference is organised

Every risk is a collapsed entry. Open one and you see a short summary, a list of ways it happens, a list of prevention measures and the related CWE numbers. A switch at the top limits the view to the web, API or LLM list, and the search box filters across everything: type a risk name, a code like A03 or API1, a CWE number like CWE-79, or a word such as deserialization or prompt.

A worked example

Press Sample, which searches for injection. The page returns three risks. From the web list, A03:2021 Injection. From the LLM list, LLM01:2025 Prompt Injection and LLM05:2025 Improper Output Handling. Below them, the CWE table shows five matching weaknesses: CWE-74 Injection (special elements in input change the structure of a command, query or message), CWE-77 Command Injection, CWE-78 OS Command Injection, CWE-89 SQL Injection and CWE-94 Code Injection. Reading the entries side by side shows how one idea, untrusted input reaching an interpreter, appears at several layers, from a database query to the prompt of a language model.

Reading CWE numbers

A CWE is a pattern, not an incident. CWE-79 is cross-site scripting, CWE-22 path traversal, CWE-352 cross-site request forgery and CWE-287 improper authentication. The weaknesses form a hierarchy: a general class such as CWE-74 has children such as CWE-89. Vulnerability databases attach CWE numbers to individual CVE records, so when a scanner reports CVE-2021-44228 with CWE-502, you can look up the pattern here and read the prevention advice.

Using it for work

Developers can use the entries as a checklist when reviewing a pull request. Testers can map findings to categories for a report. Trainers can build an exercise around one risk at a time. Remember that the lists are updated every few years, and that the rankings come from contributed data and surveys, so an item that is lower on the list may be higher for your application.

Limits

The summaries are short, written for this site, and not a substitute for the official OWASP and MITRE documents, which you should consult for exact wording and the latest editions. The CWE table covers 74 commonly cited weaknesses, not the full catalogue of more than nine hundred. Search and data live in the page, and nothing is sent.

Related tools

• CVSS Calculator scores the severity of a weakness once you have found it.
• CSP Generator and Evaluator reduces the impact of injection in the browser.
• Cookie Security Auditor addresses session weaknesses.
• Security Headers Generator and Auditor fixes common misconfigurations.