| 순번 | 2017년판 | 2021년판 | 2025년판 (최신) |
|---|---|---|---|
| 1 | Injection | Broken Access Control | Broken Access Control |
| 2 | Broken Authentication | Cryptographic Failures | Security Misconfiguration ↑3 |
| 3 | Sensitive Data Exposure | Injection | Software Supply Chain Failures 신규 |
| 4 | XML External Entities (XXE) | Insecure Design 신규 | Cryptographic Failures ↓2 |
| 5 | Broken Access Control | Security Misconfiguration | Injection |
| 6 | Security Misconfiguration | Vulnerable and Outdated Components | Insecure Design ↓2 |
| 7 | XSS | Auth Failures | Authentication Failures |
| 8 | Insecure Deserialization | Software and Data Integrity Failures 신규 | Software or Data Integrity Failures |
| 9 | Known Vulnerable Components | Logging & Monitoring Failures | Logging & Alerting Failures |
| 10 | Insufficient Logging & Monitoring | SSRF 신규 | Mishandling of Exceptional Conditions 신규 |
★ 파란 행 = 짝수 번호 항목 | SSRF(A10:2021)는 2025년에 A01 Broken Access Control에 흡수됨