◆OWASP Top 10 Learn
Home/Cheat sheets
Quick reference

Cheat sheets

One page per vulnerability - the essence of what it is, how it’s exploited, and how to prevent it. Full lessons are linked from each category page.

🌐 Web Application

Full lessons →
Edition 2025 · latest
A01
Broken Access Control
Open →Lesson
A02
Security Misconfiguration
Open →Lesson
A03
Software Supply Chain Failures
Open →Lesson
A04
Cryptographic Failures
Open →Lesson
A05
Injection
Open →Lesson
A06
Insecure Design
Open →Lesson
A07
Authentication Failures
Open →Lesson
A08
Software or Data Integrity Failures
Open →Lesson
A09
Logging & Alerting Failures
Open →Lesson
A10
Mishandling of Exceptional Conditions
Open →Lesson
Edition 2021
A01
Broken Access Control
Open →Lesson
A02
Cryptographic Failures
Open →Lesson
A03
Injection
Open →Lesson
A04
Insecure Design
Open →Lesson
A05
Security Misconfiguration
Open →Lesson
A06
Vulnerable and Outdated Components
Open →Lesson
A07
Identification and Authentication Failures
Open →Lesson
A08
Software and Data Integrity Failures
Open →Lesson
A09
Security Logging and Monitoring Failures
Open →Lesson
A10
Server-Side Request Forgery (SSRF)
Open →Lesson
Edition 2017
A1
Injection
Open →Lesson
A2
Broken Authentication
Open →Lesson
A3
Sensitive Data Exposure
Open →Lesson
A4
XML External Entities (XXE)
Open →Lesson
A5
Broken Access Control
Open →Lesson
A6
Security Misconfiguration
Open →Lesson
A7
Cross-Site Scripting (XSS)
Open →Lesson
A8
Insecure Deserialization
Open →Lesson
A9
Vulnerable and Outdated Components
Open →Lesson
A10
Insufficient Logging & Monitoring
Open →Lesson

🔌 API Security

Full lessons →
Edition 2023 · latest
API01
Broken Object Level Authorization
Open →Lesson
API02
Broken Authentication
Open →Lesson
API03
Broken Object Property Level Authorization
Open →Lesson
API04
Unrestricted Resource Consumption
Open →Lesson
API05
Broken Function Level Authorization
Open →Lesson
API06
Unrestricted Access to Sensitive Business Flows
Open →Lesson
API07
Server-Side Request Forgery (SSRF)
Open →Lesson
API08
Security Misconfiguration
Open →Lesson
API09
Improper Inventory Management
Open →Lesson
API10
Unsafe Consumption of APIs
Open →Lesson
Edition 2019
API1
Broken Object Level Authorization
Open →Lesson
API2
Broken User Authentication
Open →Lesson
API3
Excessive Data Exposure
Open →Lesson
API4
Lack of Resources & Rate Limiting
Open →Lesson
API5
Broken Function Level Authorization
Open →Lesson
API6
Mass Assignment
Open →Lesson
API7
Security Misconfiguration
Open →Lesson
API8
Injection
Open →Lesson
API9
Improper Assets Management
Open →Lesson
API10
Insufficient Logging & Monitoring
Open →Lesson

📱 Mobile

Full lessons →
Edition 2024 · latest
M01
Improper Credential Usage
Open →Lesson
M02
Inadequate Supply Chain Security
Open →Lesson
M03
Insecure Authentication/Authorization
Open →Lesson
M04
Insufficient Input/Output Validation
Open →Lesson
M05
Insecure Communication
Open →Lesson
M06
Inadequate Privacy Controls
Open →Lesson
M07
Insufficient Binary Protections
Open →Lesson
M08
Security Misconfiguration
Open →Lesson
M09
Insecure Data Storage
Open →Lesson
M10
Insufficient Cryptography
Open →Lesson
Edition 2016
M1
Improper Platform Usage
Open →Lesson
M2
Insecure Data Storage
Open →Lesson
M3
Insecure Communication
Open →Lesson
M4
Insecure Authentication
Open →Lesson
M5
Insufficient Cryptography
Open →Lesson
M6
Insecure Authorization
Open →Lesson
M7
Client Code Quality
Open →Lesson
M8
Code Tampering
Open →Lesson
M9
Reverse Engineering
Open →Lesson
M10
Extraneous Functionality
Open →Lesson

🤖 LLM & GenAI

Full lessons →
Edition 2025 · latest
LLM01
Prompt Injection
Open →Lesson
LLM02
Sensitive Information Disclosure
Open →Lesson
LLM03
Supply Chain
Open →Lesson
LLM04
Data and Model Poisoning
Open →Lesson
LLM05
Improper Output Handling
Open →Lesson
LLM06
Excessive Agency
Open →Lesson
LLM07
System Prompt Leakage
Open →Lesson
LLM08
Vector and Embedding Weaknesses
Open →Lesson
LLM09
Misinformation
Open →Lesson
LLM10
Unbounded Consumption
Open →Lesson
Edition 2023
LLM01
Prompt Injection
Open →Lesson
LLM02
Insecure Output Handling
Open →Lesson
LLM03
Training Data Poisoning
Open →Lesson
LLM04
Model Denial of Service
Open →Lesson
LLM05
Supply Chain Vulnerabilities
Open →Lesson
LLM06
Sensitive Information Disclosure
Open →Lesson
LLM07
Insecure Plugin Design
Open →Lesson
LLM08
Excessive Agency
Open →Lesson
LLM09
Overreliance
Open →Lesson
LLM10
Model Theft
Open →Lesson

☸️ Kubernetes

Full lessons →
Edition 2022 · latest
K01
Insecure Workload Configurations
Open →Lesson
K02
Supply Chain Vulnerabilities
Open →Lesson
K03
Overly Permissive RBAC Configurations
Open →Lesson
K04
Lack of Centralized Policy Enforcement
Open →Lesson
K05
Inadequate Logging and Monitoring
Open →Lesson
K06
Broken Authentication Mechanisms
Open →Lesson
K07
Missing Network Segmentation Controls
Open →Lesson
K08
Secrets Management Failures
Open →Lesson
K09
Misconfigured Cluster Components
Open →Lesson
K10
Outdated and Vulnerable Kubernetes Components
Open →Lesson

🔄 CI/CD

Full lessons →
Edition 2022 · latest
CICD-SEC-1
Insufficient Flow Control Mechanisms
Open →Lesson
CICD-SEC-2
Inadequate Identity and Access Management
Open →Lesson
CICD-SEC-3
Dependency Chain Abuse
Open →Lesson
CICD-SEC-4
Poisoned Pipeline Execution (PPE)
Open →Lesson
CICD-SEC-5
Insufficient PBAC (Pipeline-Based Access Controls)
Open →Lesson
CICD-SEC-6
Insufficient Credential Hygiene
Open →Lesson
CICD-SEC-7
Insecure System Configuration
Open →Lesson
CICD-SEC-8
Ungoverned Usage of 3rd Party Services
Open →Lesson
CICD-SEC-9
Improper Artifact Integrity Validation
Open →Lesson
CICD-SEC-10
Insufficient Logging and Visibility
Open →Lesson

🧠 ML Security

Full lessons →
Edition 2023 · latest
ML01
Input Manipulation Attack
Open →Lesson
ML02
Data Poisoning Attack
Open →Lesson
ML03
Model Inversion Attack
Open →Lesson
ML04
Membership Inference Attack
Open →Lesson
ML05
Model Theft
Open →Lesson
ML06
AI Supply Chain Attacks
Open →Lesson
ML07
Transfer Learning Attack
Open →Lesson
ML08
Model Skewing
Open →Lesson
ML09
Output Integrity Attack
Open →Lesson
ML10
Model Poisoning
Open →Lesson

📜 Smart Contract

Full lessons →
Edition 2025 · latest
SC01
Access Control Vulnerabilities
Open →Lesson
SC02
Price Oracle Manipulation
Open →Lesson
SC03
Logic Errors
Open →Lesson
SC04
Lack of Input Validation
Open →Lesson
SC05
Reentrancy Attacks
Open →Lesson
SC06
Unchecked External Calls
Open →Lesson
SC07
Flash Loan Attacks
Open →Lesson
SC08
Integer Overflow and Underflow
Open →Lesson
SC09
Insecure Randomness
Open →Lesson
SC10
Denial of Service Attacks
Open →Lesson

⚡ Serverless

Full lessons →
Edition 2018 · latest
SAS-1
Function Event-Data Injection
Open →Lesson
SAS-2
Broken Authentication
Open →Lesson
SAS-3
Insecure Serverless Deployment Configuration
Open →Lesson
SAS-4
Over-Privileged Function Permissions & Roles
Open →Lesson
SAS-5
Inadequate Function Monitoring and Logging
Open →Lesson
SAS-6
Insecure Third-Party Dependencies
Open →Lesson
SAS-7
Insecure Application Secrets Storage
Open →Lesson
SAS-8
Denial of Service & Financial Resource Exhaustion
Open →Lesson
SAS-9
Serverless Business Logic Manipulation
Open →Lesson
SAS-10
Improper Exception Handling & Verbose Error Messages
Open →Lesson

🛡️ Proactive Controls

Full lessons →
Edition 2024 · latest
C1
Implement Access Control
Open →Lesson
C2
Use Cryptography to Protect Data
Open →Lesson
C3
Validate all Input & Handle Exceptions
Open →Lesson
C4
Address Security from the Start
Open →Lesson
C5
Secure By Default Configurations
Open →Lesson
C6
Keep your Components Secure
Open →Lesson
C7
Secure Digital Identities
Open →Lesson
C8
Leverage Browser Security Features
Open →Lesson
C9
Implement Security Logging and Monitoring
Open →Lesson
C10
Stop Server-Side Request Forgery
Open →Lesson