[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a06":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",175,"OWASP Foundation","**What it asks for.** This category covers risk from using libraries, frameworks, runtimes and other components that are unsupported, out of date or known to be vulnerable. It applies to client and server side components and their nested dependencies, and includes failing to know which versions are in use or to scan and patch them in a timely way.\n\n**In practice.** Organisations maintain an inventory of components, ideally as a software bill of materials, and use software composition analysis in the build pipeline. Unused dependencies are removed, components come from trusted sources and updates are applied on a defined schedule, with faster handling for exploited issues. Evidence includes SBOMs, scan results, patching metrics and documented exceptions for components that cannot yet be upgraded.\n\n**Common gaps.** Transitive dependencies and container base images are often missed. Teams also accumulate end of life frameworks that receive no fixes, with no plan to migrate.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA06_2021-Vulnerable_and_Outdated_Components\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},946,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ai-powered-tools-aim-to-close-the-gap-between-vulnerability-discovery-and-remediation","AI-Powered Tools Aim to Close the Gap Between Vulnerability Discovery and Remediation","2026-11-13T10:21:46.443+00:00",{"slug":24,"title":25,"published_at":26},"ai-powered-security-testing-tools-raise-the-bar-for-automated-vulnerability-management","AI-Powered Security Testing Tools Raise the Bar for Automated Vulnerability Management","2026-11-13T10:21:28.79+00:00",{"slug":28,"title":29,"published_at":30},"automating-remediation-is-essential-to-closing-the-gap-between-vulnerability-discovery-and-fix","Automating Remediation Is Essential to Closing the Gap Between Vulnerability Discovery and Fix","2026-11-12T19:20:38.763+00:00",{"slug":32,"title":33,"published_at":34},"client-side-supply-chain-attacks-bypass-all-traditional-security-controls","Client-Side Supply Chain Attacks Bypass All Traditional Security Controls","2026-11-12T15:22:17.578+00:00",{"slug":36,"title":37,"published_at":38},"client-side-supply-chain-attacks-can-bypass-all-security-controls-at-runtime","Client-Side Supply Chain Attacks Can Bypass All Security Controls at Runtime","2026-11-12T15:21:39.056+00:00",{"slug":40,"title":41,"published_at":42},"nodejs-patches-16-flaws-including-memory-leak-exploitable-by-unauthenticated-clients","Node.js Patches 16 Flaws Including Memory Leak Exploitable by Unauthenticated Clients","2026-11-11T19:20:23.205+00:00",{"slug":44,"title":45,"published_at":46},"ai-coding-assistant-mcp-servers-expose-api-keys-via-poisoned-dependencies","AI Coding Assistant MCP Servers Expose API Keys via Poisoned Dependencies","2026-11-11T17:20:58.508+00:00",{"slug":48,"title":49,"published_at":50},"git-patches-six-flaws-including-remote-code-execution-via-malicious-repositories","Git Patches Six Flaws Including Remote Code Execution via Malicious Repositories","2026-11-11T15:20:21.208+00:00",{"slug":52,"title":53,"published_at":54},"six-git-vulnerabilities-enable-malicious-code-execution-via-cloned-repositories","Six Git Vulnerabilities Enable Malicious Code Execution via Cloned Repositories","2026-11-11T12:20:41.85+00:00",{"slug":56,"title":57,"published_at":58},"unpatched-rce-in-open-source-ai-framework-leads-to-data-breach-across-users-and-ai-agents","Unpatched RCE in Open-Source AI Framework Leads to Data Breach Across Users and AI Agents","2026-11-10T20:21:39.641+00:00",{"slug":60,"title":61,"published_at":62},"critical-sap-netweaver-flaws-demand-immediate-patching-action","Critical SAP NetWeaver Flaws Demand Immediate Patching Action","2026-11-10T12:22:07.64+00:00",{"slug":64,"title":65,"published_at":66},"ai-powered-bug-hunting-raises-the-stakes-for-vulnerability-management","AI-Powered Bug Hunting Raises the Stakes for Vulnerability Management","2026-11-10T12:21:05.467+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",552,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",550,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",299,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",202,{"slug":89,"name":90,"problem":91,"stories":92},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",186,{"slug":94,"name":95,"problem":96,"stories":97},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",89,[99,105,111,117,123,129,135,140],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",833,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","7","Control 7","Continuous Vulnerability Management",781,{"family":112,"item":113,"code":114,"title":115,"together":116},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",760,{"family":118,"item":119,"code":120,"title":121,"together":122},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",663,{"family":124,"item":125,"code":126,"title":127,"together":128},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",650,{"family":130,"item":131,"code":132,"title":133,"together":134},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",351,{"family":106,"item":136,"code":137,"title":138,"together":139},"17","Control 17","Incident Response Management",246,{"family":106,"item":141,"code":142,"title":143,"together":144},"2","Control 2","Inventory and Control of Software Assets",188]