OWASP Top 10
Industry-standard list of the 10 most critical web application security risks. OWASP (Open Worldwide Application Security Project) updates every 3–4 years. Latest 2021 (2025 version expected).
2021 list: A01 Broken Access Control (#1), A02 Cryptographic Failures, A03 Injection (SQLi, etc.), A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Identification/Auth, A08 Software/Data Integrity, A09 Logging/Monitoring, A10 SSRF. Referenced in compliance (PCI-DSS, ISO 27001, NIST). OWASP also maintains Cheat Sheets, ZAP scanner, ASVS (verification standard).