OWASP Top 10 (2021)

1. A01 Broken Access Control

   Access control enforcement, IDOR, privilege escalation, CORS misconfiguration, forced browsing and deny-by-default.

2. A02 Cryptographic Failures

   Sensitive data exposure in transit and at rest, weak algorithms, key management, TLS and hashing failures.

3. A03 Injection

   SQL, NoSQL, OS command, LDAP and XSS injection, parameterized queries and input validation.

4. A04 Insecure Design

   Threat modeling, secure design patterns, reference architectures and abuse cases versus implementation bugs.

5. A05 Security Misconfiguration

   Default accounts, verbose errors, unnecessary features, missing hardening, XXE and cloud permission misconfiguration.

6. A06 Vulnerable and Outdated Components

   Dependency inventory, patch management, unsupported components and software composition analysis.

7. A07 Identification and Authentication Failures

   Credential stuffing, weak passwords, session fixation, missing MFA and session ID handling.

8. A08 Software and Data Integrity Failures

   Insecure deserialization, unsigned updates, CI/CD pipeline integrity and untrusted CDN or plugin sources.

9. A09 Security Logging and Monitoring Failures

   Auditable event logging, alerting, log integrity, log injection and incident response detection.

10. A10 Server-Side Request Forgery

    SSRF via user-supplied URLs, allow-lists, network segmentation and cloud metadata service access.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.