OWASP Top 10 scanning: 2021 vs. 2025, and what Vooki Pro maps to

OWASP isn't a regulator, and the Top 10 isn't a law — it's the de facto baseline most assessors expect a web application security test to cover. OWASP published an updated Top 10:2025 in November 2025, the first revision since 2021. Here's what changed, and which edition Vooki Pro's compliance report currently maps to.

Start 7-Day Trial All frameworks & baselines

What's new

OWASP Top 10:2025, in brief

Released November 2025

OWASP released the Top 10:2025 at the Global AppSec Conference in Washington, D.C. — the first update to the list since 2021, built from analysis of over 175,000 CVEs and practitioner survey data.

Two new categories

A03:2025 Software Supply Chain Failures and A10:2025 Mishandling of Exceptional Conditions are new entries that didn't exist as named categories in 2021.

SSRF absorbed

Server-Side Request Forgery, a standalone category in the 2021 list, was folded into Broken Access Control in the 2025 revision rather than remaining its own entry.

Category list from OWASP's official Top 10:2025 page; see owasp.org/Top10/2025/ for each category's full write-up.

Honest answer

Which edition does Vooki Pro map to?

Currently: OWASP Top 10 2021

Vooki Pro's compliance report generator and per-finding knowledge-base tags currently reference the OWASP Top 10 2021 edition's categories. A mapping to the 2025 categories is not currently available.

Still useful for the categories that carried over

Most 2021 categories (Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Identification and Authentication Failures, and others) remain conceptually present in 2025, sometimes renamed or merged. A 2021-mapped report still covers most of the same underlying vulnerability classes — it just doesn't yet reflect the two new 2025 categories or the 2025 numbering.

If you need a 2025-mapped report

Vooki Pro does not currently generate an OWASP Top 10:2025-mapped report. If your audit or client specifically requires one, contact us before relying on the 2021 mapping.

FAQ

Common questions

Is OWASP Top 10 a compliance requirement?

Not on its own — OWASP is not a regulator and the Top 10 is not a law. It's a widely-referenced awareness document, and other frameworks (like PCI DSS) and many assessors use it as a practical baseline for what "reasonable" web application security testing should cover.

What changed in OWASP Top 10:2025 versus 2021?

Two new categories appeared: A03:2025 Software Supply Chain Failures and A10:2025 Mishandling of Exceptional Conditions. Server-Side Request Forgery (SSRF), its own category in 2021, was folded into Broken Access Control. The list was built from over 175,000 analyzed CVEs and practitioner survey data.

Which OWASP Top 10 edition does Vooki Pro currently map to?

The 2021 edition. OWASP published the Top 10:2025 update in November 2025; a mapping to the 2025 categories is not currently available in Vooki Pro.

See the report generator docs · or browse other frameworks

Sources

OWASP Top 10:2025 (official)
The Register — "OWASP Top 10: Broken access control still tops app security list"
Vooki Pro documentation: Reports & Compliance · Scan Results & Findings · CLI & CI/CD
Last reviewed 23 October 2026.

Cover the OWASP Top 10 essentials out of the box

No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.

Start 7-Day Trial All frameworks & baselines