[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Fasvs":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","asvs","ASVS","OWASP Application Security Verification Standard (ASVS)",115,"OWASP Foundation","**What it covers.** The ASVS is an OWASP standard that lists security requirements for designing, building and testing web applications and services. Requirements are grouped by area, such as authentication, session management, access control, input handling, cryptography and logging, and assigned to three levels of increasing rigour so that organisations can match verification depth to the application's risk.\n\n**In practice.** Organisations pick a target level per application, use ASVS requirements as security acceptance criteria and as a basis for testing scope, and track compliance over time. Evidence includes requirement mappings, test results that reference ASVS identifiers and documented exceptions. It can also be used to set expectations in contracts with development suppliers.\n\n**Common gaps.** Teams sometimes claim a level without verifying each requirement. Version differences also cause confusion, so requirement identifiers should always be cited with the version used.",null,"https:\u002F\u002Fowasp.org\u002Fwww-project-application-security-verification-standard\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},113,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","2026-10-16T18:20:18.997+00:00",{"slug":24,"title":25,"published_at":26},"ics-sniper-xworm-rce-and-ai-introduced-software-flaws-highlight-diverse-attack-surface","ICS-Sniper, XWorm RCE, and AI-Introduced Software Flaws Highlight Diverse Attack Surface","2026-10-16T16:20:31.539+00:00",{"slug":28,"title":29,"published_at":30},"zero-click-sneakpeek-flaw-silently-exfiltrates-developer-credentials-from-claude-code","Zero-Click 'SneakPeek' Flaw Silently Exfiltrates Developer Credentials from Claude Code","2026-10-14T22:21:07.285+00:00",{"slug":32,"title":33,"published_at":34},"ai-agent-exposes-critical-otp-bypass-in-live-insurance-portal","AI Agent Exposes Critical OTP Bypass in Live Insurance Portal","2026-10-14T12:21:03.121+00:00",{"slug":36,"title":37,"published_at":38},"sap-cloud-sdk-flaw-exposes-oauth2-credentials-due-to-patch-regression","SAP Cloud SDK Flaw Exposes OAuth2 Credentials Due to Patch Regression","2026-10-13T20:22:04.987+00:00",{"slug":40,"title":41,"published_at":42},"anthropic-ai-models-exploit-government-sites-during-testing","Anthropic AI Models Exploit Government Sites During Testing","2026-10-12T20:20:33.279+00:00",{"slug":44,"title":45,"published_at":46},"googles-ai-agent-pagebreak-uncovers-500-web-app-vulnerabilities","Google's AI Agent PageBreak Uncovers 500+ Web App Vulnerabilities","2026-10-06T20:20:53.594+00:00",{"slug":48,"title":49,"published_at":50},"critical-auth-flaws-in-ev-charging-app-enable-full-admin-takeover","Critical Auth Flaws in EV Charging App Enable Full Admin Takeover","2026-10-01T18:22:05.631+00:00",{"slug":52,"title":53,"published_at":54},"auth-flaw-in-microsoft-titan-exposes-173-trillion-data-rows","Auth Flaw in Microsoft Titan Exposes 17.3 Trillion Data Rows","2026-09-29T12:21:08.395+00:00",{"slug":56,"title":57,"published_at":58},"ai-powered-recon-hardcoded-secrets-in-android-apks-exploited-at-scale","AI-Powered Recon: Hardcoded Secrets in Android APKs Exploited at Scale","2026-09-11T22:20:21.475+00:00",{"slug":60,"title":61,"published_at":62},"password-reset-flaw-exposes-200k-florida-dmv-driver-records","Password-Reset Flaw Exposes 200K+ Florida DMV Driver Records","2026-09-08T18:21:40.455+00:00",{"slug":64,"title":65,"published_at":66},"wraith-framework-exploits-browser-sessions-for-silent-data-harvesting","WRAITH Framework Exploits Browser Sessions for Silent Data Harvesting","2026-09-07T08:20:22.265+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",54,{"slug":74,"name":75,"problem":76,"stories":77},"patch-management","Automated patch management","Known holes get closed in days, not months.",47,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",39,{"slug":84,"name":85,"problem":86,"stories":87},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",25,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",18,{"slug":94,"name":95,"problem":96,"stories":97},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",12,[99,105,111,116,121,126,131,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",72,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","si-2","SI-2","Flaw Remediation",40,{"family":100,"item":112,"code":113,"title":114,"together":115},"16","Control 16","Application Software Security",34,{"family":100,"item":117,"code":118,"title":119,"together":120},"6","Control 6","Access Control Management",29,{"family":106,"item":122,"code":123,"title":124,"together":125},"ac-2","AC-2","Account Management",28,{"family":100,"item":127,"code":128,"title":129,"together":130},"2","Control 2","Inventory and Control of Software Assets",24,{"family":132,"item":133,"code":134,"title":135,"together":136},"gdpr","32","Article 32","Security of processing",23,{"family":106,"item":138,"code":139,"title":140,"together":141},"si-10","SI-10","Information Input Validation",17]