· 10 min read
OWASP Top 10:2025: What Changed Since 2021, and What I Keep Finding in Real Audits
Two new categories, SSRF folded into access control, and misconfiguration jumping to number 2. Here's the 2025 list explained, mapped to what actually turns up when you audit a production system.
