OWASP Top 10 directory
A directory of OWASP Top 10 projects verified as of October 27, 2026.
Here is a GitHub directory of OWASP Top 10 projects I could verify as of October 27, 2026. I’m listing the projects themselves—not the ten individual risks within each project.
OWASP’s Top 10 family includes separate lists for web applications, APIs, mobile, AI, infrastructure, and other domains. Not every project has a finalized, year-numbered release; some are drafts or historical repositories. owasp
Application security and secure development
| Project | GitHub repository | Latest edition or status verified |
|---|---|---|
| OWASP Top 10 — Web Application Security Risks | OWASP/Top10 | 2025 final; supersedes 2021. github |
| API Security Top 10 | OWASP/API-Security | 2023 edition located. github |
| Mobile Top 10 | OWASP/www-project-mobile-top-10 | 2024 final. github |
| Desktop App Security Top 10 | OWASP/www-project-desktop-app-security-top-10 | 2021 edition. github |
| Top 10 Proactive Controls | OWASP/www-project-proactive-controls | 2024 tagged release verified; repository also contains current working content. This is a controls list rather than a vulnerability ranking. github |
| Top 10 for Business Logic Abuse | OWASP/www-project-top-10-for-business-logic-abuse | Repository and risk documentation available; final edition year not verified. github |
| Low-Code/No-Code Top 10 / Citizen Development Top 10 Security Risks | OWASP/www-project-citizen-development-top10-security-risks | OWASP lists the Low-Code/No-Code project; its repository includes discussion of renaming it for citizen development. Treat these as one project lineage, not two independent lists. owasp |
| Smart Contract Top 10 | OWASP/www-project-smart-contract-top-10 | 2026 edition; its forward-looking ranking uses incidents and survey data from 2025. github |
AI, LLM, and agent security
| Project | GitHub repository | Latest edition or status verified |
|---|---|---|
| GenAI / LLM Top 10 | GenAI-Security-Project/GenAI-LLM-Top10 | 2026, published August 4, 2026. The previous OWASP repository explicitly redirects active development here. genai.owasp |
| Machine Learning Security Top 10 | OWASP/www-project-machine-learning-security-top-10 | OWASP describes the current work as a frequently modified draft. owasp |
| MCP Top 10 | OWASP/www-project-mcp-top-10 | Repository contains 2025-numbered risks; no packaged GitHub release was listed. github |
| Agentic Skills Top 10 | OWASP/www-project-agentic-skills-top-10 | Available framework focused specifically on AI-agent skills and their tools-layer risks. github |
There is also an OWASP Top 10 for Agentic Applications 2026, covering autonomous agents at the application/system level. I verified its official publication, but not a dedicated canonical GitHub repository for the Top 10 document itself, so I have not substituted an unofficial mirror in the table. It is distinct from the Agentic Skills Top 10. github
The older OWASP LLM repository remains useful for historical editions and translations, but it is now a legacy entry point—not the current development repository. github
Cloud, DevSecOps, infrastructure, and IoT
| Project | GitHub repository | Latest edition or status verified |
|---|---|---|
| Top 10 CI/CD Security Risks | OWASP/www-project-top-10-ci-cd-security-risks | Published framework and risk documents available; a newer year-numbered edition was not verified. github |
| Kubernetes Top Ten | OWASP/www-project-kubernetes-top-ten | 2025 risk list available in the repository. github |
| Cloud-Native Application Security Top 10 | OWASP/www-project-cloud-native-application-security-top-10 | Interim / under-review material, including a 2022 content tree. The separate older source repository is archived. github |
| Top 10 Infrastructure Security Risks | OWASP/www-project-top-10-infrastructure-security-risks | Repository located; finalized edition/version not verified. github |
| IoT Top 10 | OWASP/www-project-internet-of-things | 2018 list remains available within the broader IoT project. github |
| Subtractive Hardening / Subtractive Security Top 10 | OWASP/OWASP-Subtractive-Hardening-Top-10 | Repository provides attack-path-removal guidance and platform-specific Top 10 documents, including IoT. github |
| Top 10 Neocloud and AI Data Center Security Risks | OWASP/OWASP-Top-10-Neocloud-and-AI-Data-Center-Security-Risks | Repository located; finalized edition/version not verified. github |
OWASP also maintains the Serverless Top 10 project. Its official page currently provides the Serverless Interpretation report and describes further work toward an official Serverless Top 10 report. I did not verify the canonical source-repository URL, so I’m not guessing one. owasp
Data, privacy, and industry-specific projects
| Project | GitHub repository | Latest edition or status verified |
|---|---|---|
| Data Security Top 10 | OWASP/www-project-data-security-top-10 | Repository available; finalized latest edition not verified. github |
| Top 10 Privacy Risks | OWASP/www-project-top-10-privacy-risks | Version 2.0 / 2021. Repository archived March 15, 2025. github |
| Top 10 for Maritime Security | OWASP/www-project-top-10-for-maritime-security | Development-stage initiative; repository describes the roadmap rather than establishing a verified final edition. github |
Scope and completeness
This is a verified directory, not a guaranteed exhaustive count of every newly created OWASP repository. It separates released editions from working drafts, archived material, and repositories whose release status could not be confirmed. OWASP’s project inventory is broader and changes over time; a repository’s existence or recent commit date alone does not establish a new finalized Top 10 edition. owasp