[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a05":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a05","A05:2021","A05:2021 Security Misconfiguration",63,"OWASP Foundation","**What it asks for.** This category covers insecure configuration of applications, frameworks, servers, cloud services and platforms. Examples include default accounts and passwords, unnecessary features or services enabled, verbose error messages, missing security headers, overly permissive cloud storage and inconsistent hardening across environments. XML external entity issues were folded into this category in 2021.\n\n**In practice.** Organisations use hardened baseline configurations, apply them automatically through infrastructure as code, keep environments consistent and remove unused features. Configuration is checked continuously with scanning and cloud posture tools. Evidence includes hardening standards, configuration scan results, drift reports and remediation records.\n\n**Common gaps.** Cloud services are often configured outside the normal pipeline, so baselines are not applied. Test and staging environments frequently have weaker settings and real data.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA05_2021-Security_Misconfiguration\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"vibetech-exposes-137m-records-in-unsecured-database","Vibetech Exposes 13.7M Records in Unsecured Database","2026-10-15T16:20:19.435+00:00",{"slug":23,"title":24,"published_at":25},"ai-augmented-cyberxero-campaign-exfiltrates-628000-ukrainian-records","AI-Augmented CyberXero Campaign Exfiltrates 628,000+ Ukrainian Records","2026-10-12T08:20:22.332+00:00",{"slug":27,"title":28,"published_at":29},"clickfix-lure-drives-lunex-stealer-across-100-ukrainian-sites","ClickFix Lure Drives Lunex Stealer Across 100+ Ukrainian Sites","2026-10-07T10:20:38.802+00:00",{"slug":31,"title":32,"published_at":33},"rejetto-hfs-weak-prng-allows-admin-session-forgery-and-rce","Rejetto HFS Weak PRNG Allows Admin Session Forgery and RCE","2026-10-05T10:21:07.064+00:00",{"slug":35,"title":36,"published_at":37},"self-healing-wordpress-malware-defeats-traditional-cleanup-methods","Self-Healing WordPress Malware Defeats Traditional Cleanup Methods","2026-10-01T04:20:20.317+00:00",{"slug":39,"title":40,"published_at":41},"self-registration-exploit-leads-to-webshell-implant-on-municipal-recreation-platform","Self-Registration Exploit Leads to Webshell Implant on Municipal Recreation Platform","2026-09-30T16:21:13.611+00:00",{"slug":43,"title":44,"published_at":45},"16000-supabase-databases-exposed-due-to-misconfiguration","16,000+ Supabase Databases Exposed Due to Misconfiguration","2026-09-28T20:20:34.344+00:00",{"slug":47,"title":48,"published_at":49},"shinyhunters-exploit-oracle-peoplesoft-flaw-by-bypassing-waf-defenses","ShinyHunters Exploit Oracle PeopleSoft Flaw by Bypassing WAF Defenses","2026-09-26T20:21:42.897+00:00",{"slug":51,"title":52,"published_at":53},"elementor-csrf-flaw-enables-unauthorized-admin-account-creation","Elementor CSRF Flaw Enables Unauthorized Admin Account Creation","2026-09-25T20:20:22.675+00:00",{"slug":55,"title":56,"published_at":57},"wordpress-xss-to-rce-flaw-turns-admin-sessions-into-server-takeover","WordPress XSS-to-RCE Flaw Turns Admin Sessions Into Server Takeover","2026-09-22T08:21:22.477+00:00",{"slug":59,"title":60,"published_at":61},"wordpress-csrf-flaw-enables-remote-php-execution-via-admin-trick","WordPress CSRF Flaw Enables Remote PHP Execution via Admin Trick","2026-09-21T20:20:30.767+00:00",{"slug":63,"title":64,"published_at":65},"openai-codex-sandbox-escapes-highlight-ai-tool-isolation-risks","OpenAI Codex Sandbox Escapes Highlight AI Tool Isolation Risks","2026-09-20T14:20:21.478+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",35,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",32,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",24,{"slug":83,"name":84,"problem":85,"stories":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",9,{"slug":88,"name":89,"problem":90,"stories":91},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",7,{"slug":93,"name":94,"problem":95,"stories":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,103,109,115,120,125,130,135],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","7","Control 7","Continuous Vulnerability Management",49,{"family":104,"item":105,"code":106,"title":107,"together":108},"nist-800-53","si-2","SI-2","Flaw Remediation",42,{"family":110,"item":111,"code":112,"title":113,"together":114},"gdpr","32","Article 32","Security of processing",41,{"family":98,"item":116,"code":117,"title":118,"together":119},"4","Control 4","Secure Configuration of Enterprise Assets and Software",34,{"family":121,"item":122,"code":123,"title":123,"together":124},"itil","overview","ITIL",31,{"family":98,"item":126,"code":127,"title":128,"together":129},"2","Control 2","Inventory and Control of Software Assets",22,{"family":98,"item":131,"code":132,"title":133,"together":134},"12","Control 12","Network Infrastructure Management",21,{"family":104,"item":136,"code":137,"title":138,"together":134},"cm-6","CM-6","Configuration Settings"]