[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a05":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a05","A05:2021","A05:2021 Security Misconfiguration",63,"OWASP Foundation","**What it asks for.** This category covers insecure configuration of applications, frameworks, servers, cloud services and platforms. Examples include default accounts and passwords, unnecessary features or services enabled, verbose error messages, missing security headers, overly permissive cloud storage and inconsistent hardening across environments. XML external entity issues were folded into this category in 2021.\n\n**In practice.** Organisations use hardened baseline configurations, apply them automatically through infrastructure as code, keep environments consistent and remove unused features. Configuration is checked continuously with scanning and cloud posture tools. Evidence includes hardening standards, configuration scan results, drift reports and remediation records.\n\n**Common gaps.** Cloud services are often configured outside the normal pipeline, so baselines are not applied. Test and staging environments frequently have weaker settings and real data.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA05_2021-Security_Misconfiguration\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},69,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"internet-facing-containers-with-sensitive-data-access-create-exploitable-attack-paths","Internet-Facing Containers with Sensitive Data Access Create Exploitable Attack Paths","2026-11-13T18:21:17.032+00:00",{"slug":24,"title":25,"published_at":26},"unsecured-ai-agent-exposes-enterprise-to-invoice-fraud-via-email-manipulation","Unsecured AI Agent Exposes Enterprise to Invoice Fraud via Email Manipulation","2026-11-13T16:22:22.358+00:00",{"slug":28,"title":29,"published_at":30},"ai-powered-penetration-testing-and-remediation-tools-reshape-vulnerability-management","AI-Powered Penetration Testing and Remediation Tools Reshape Vulnerability Management","2026-11-13T08:21:15.6+00:00",{"slug":32,"title":33,"published_at":34},"grok-ai-platform-exposes-35000-apps-via-insecure-default-access-settings","Grok AI Platform Exposes 35,000+ Apps via Insecure Default Access Settings","2026-11-11T13:21:21.727+00:00",{"slug":36,"title":37,"published_at":38},"unpatched-openwave-and-cisco-broadworks-flaws-actively-exploited-in-targeted-campaigns","Unpatched Openwave and Cisco BroadWorks Flaws Actively Exploited in Targeted Campaigns","2026-11-11T10:21:42.735+00:00",{"slug":40,"title":41,"published_at":42},"forticlient-cors-misconfiguration-enables-remote-code-execution-via-malicious-websites","FortiClient CORS Misconfiguration Enables Remote Code Execution via Malicious Websites","2026-11-11T08:21:24.524+00:00",{"slug":44,"title":45,"published_at":46},"vibetech-exposes-137m-records-in-unsecured-database","Vibetech Exposes 13.7M Records in Unsecured Database","2026-10-15T16:20:19.435+00:00",{"slug":48,"title":49,"published_at":50},"ai-augmented-cyberxero-campaign-exfiltrates-628000-ukrainian-records","AI-Augmented CyberXero Campaign Exfiltrates 628,000+ Ukrainian Records","2026-10-12T08:20:22.332+00:00",{"slug":52,"title":53,"published_at":54},"clickfix-lure-drives-lunex-stealer-across-100-ukrainian-sites","ClickFix Lure Drives Lunex Stealer Across 100+ Ukrainian Sites","2026-10-07T10:20:38.802+00:00",{"slug":56,"title":57,"published_at":58},"rejetto-hfs-weak-prng-allows-admin-session-forgery-and-rce","Rejetto HFS Weak PRNG Allows Admin Session Forgery and RCE","2026-10-05T10:21:07.064+00:00",{"slug":60,"title":61,"published_at":62},"self-healing-wordpress-malware-defeats-traditional-cleanup-methods","Self-Healing WordPress Malware Defeats Traditional Cleanup Methods","2026-10-01T04:20:20.317+00:00",{"slug":64,"title":65,"published_at":66},"self-registration-exploit-leads-to-webshell-implant-on-municipal-recreation-platform","Self-Registration Exploit Leads to Webshell Implant on Municipal Recreation Platform","2026-09-30T16:21:13.611+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",37,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",36,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",24,{"slug":84,"name":85,"problem":86,"stories":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",11,{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",8,{"slug":94,"name":95,"problem":96,"stories":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",7,[99,105,111,117,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",53,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","si-2","SI-2","Flaw Remediation",44,{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","32","Article 32","Security of processing",41,{"family":100,"item":118,"code":119,"title":120,"together":72},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":122,"item":123,"code":124,"title":124,"together":125},"itil","overview","ITIL",31,{"family":100,"item":127,"code":128,"title":129,"together":130},"2","Control 2","Inventory and Control of Software Assets",22,{"family":100,"item":132,"code":133,"title":134,"together":135},"12","Control 12","Network Infrastructure Management",21,{"family":106,"item":137,"code":138,"title":139,"together":135},"cm-6","CM-6","Configuration Settings"]