What changed in Top 10:2025, and why

The Top 10 is not a ranking by vibes. Eight of the ten categories are ordered from data gathered across hundreds of thousands of applications; the other two come from a community survey, reserved for risks that scanning data has not caught up with yet. Knowing which group a category is in tells you how far to trust its position.

Three changes worth a backend developer reading carefully:

(1) A03 — Software Supply Chain Failures. The 2021 edition called it "Vulnerable and Outdated Components" and the answer was short: update your dependencies. The 2025 edition widens it to the whole supply chain: not just the libraries in your package.json but the build system, the CI actions, the base image, and the machine that built the artefact. It climbed to third because real attacks went through exactly those doors.

(2) A10 — Mishandling of Exceptional Conditions. A brand-new category. It is the home for a family of bugs that previously had none: failing open when a dependency dies, different error messages for accounts that exist and accounts that do not, race conditions on the error path, and the empty catch (Exception) { }. The common thread: the system behaves correctly on the happy path and incorrectly on the failure path.

(3) A05 — Injection now includes XSS. XSS no longer has its own category. This is contested but mechanically right: XSS is injection, just with a different interpreter (the browser rather than the database). Merging keeps one fix for the whole class: separate data from command, encode for the output context.

A01 "Broken Access Control" still tops the list, two editions running. Nothing new there — and that is precisely what is worth noticing.