https://github.com/OWASP/www-project-top-10-infrastructure-security-risks
OWASP Top 10 Infrastructure Security Risks - An OWASP other project
To further improve the quality and significance of the OWASP Top 10 Infrastructure Security Risks, we kindly invite you to join our Open Call for Data for 2025 and 2026. There, you can contribute data, anonymously or publicly, to the project. Throughout 2025 and 2026, we will collect all the data and then process this data for use to the end of the year in 2026. This way, we plan to publish the OWASP Top 10 Infrastructure Security Risks - Version 2026 using an even more extensive dataset and further improve the quality and significance. If desired, contributors and donors will be recognized as sponsors on the relevant project pages. We also have plans to conduct CVE and CWE research for vulnerabilities regarding Infrastructure Security Risks.
We are looking for data regarding vulnerabilities in the context of Infrastructure Security Risks e.g. findings from internal penetration tests or similar.
That way we can use the resulting dataset to evaluate what are the most common and critical vulnerabilities arising in internal IT-infrastructures.
To submit data, please prepare your data to fit to the following CSV structure and submit it as preferably one CSV file.
DISCLAIMER: ONLY SUMBIT ANONYMIZED DATA NOT SHOWING RELATIONS TO THE TARGET / CUSTOMER!
How to send the data is explained in the linked Google Forms Document where you need to fill in additional data. The submission of the Google Forms Document, alongside the data, is mandatory to participate.
Even though we present a CSV structure you can submit data in other formats to. Important is that we are able to categorize the findings by year and test type. If data is submitted in other formats we can not guarantee that we will able to process it.
id, count, year, title, test type, CWE/Category, (CVE) , (CVSS v3 score), (CVSS v3 vector), (CVSS v4 score), (CVSS v4 vector), (ISRXX:2024), (description and details), (risk), (rectification)
id, count, year, title, test type, CWE/Category, (CVE) , (CVSS v3 score), (CVSS v3 vector), (CVSS v4 score), (CVSS v4 vector), (ISRXX:2024), (description and details), (risk), (rectification)
#1, 42, 2025, Unsupported windows XP client with known vulnerabilities, Internal Infrastructure Penetration Test, CWE-1104, CVE-2000-1234 , 10.0, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, ISR01:2024, A Windows XP Client was found. This version of Windows from Microsoft isn't supported anymore. There are no longer security patches and many publicly known exploits exists, including critical ones., Because this version of windows is no longer supported and there aren't security patches anymore, the number of known and critical exploits, without solutions to them, increases by time. These vulnerabilities can lead to the whole compromization of the system., It is recommended to upgrade the system to a up-to-date and supported version.
When you fill out the Google Forms Document, you will also be asked to enter additional information about yourself and your data.
Further explanation is stated in the Google Forms Document.
If you have any questions regarding this process, feel free to write us an E-Mail:
Nick Lorenz and Tim Barsch
Project Resources
Project Leaders
Nick Lorenz
Project Information
Incubator Project
Classification
Standards
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.