[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a06":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",175,"OWASP Foundation","**What it asks for.** This category covers risk from using libraries, frameworks, runtimes and other components that are unsupported, out of date or known to be vulnerable. It applies to client and server side components and their nested dependencies, and includes failing to know which versions are in use or to scan and patch them in a timely way.\n\n**In practice.** Organisations maintain an inventory of components, ideally as a software bill of materials, and use software composition analysis in the build pipeline. Unused dependencies are removed, components come from trusted sources and updates are applied on a defined schedule, with faster handling for exploited issues. Evidence includes SBOMs, scan results, patching metrics and documented exceptions for components that cannot yet be upgraded.\n\n**Common gaps.** Transitive dependencies and container base images are often missed. Teams also accumulate end of life frameworks that receive no fixes, with no plan to migrate.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA06_2021-Vulnerable_and_Outdated_Components\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},176,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"siteguard-waf-os-command-injection-exploited-for-root-access","SiteGuard WAF OS Command Injection Exploited for Root Access","2026-10-18T16:20:26.047+00:00",{"slug":24,"title":25,"published_at":26},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","2026-10-17T16:20:34.593+00:00",{"slug":28,"title":29,"published_at":30},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":32,"title":33,"published_at":34},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":36,"title":37,"published_at":38},"critical-rce-flaws-in-nextjs-demand-immediate-patching","Critical RCE Flaws in Next.js Demand Immediate Patching","2026-10-15T16:21:23.504+00:00",{"slug":40,"title":41,"published_at":42},"critical-litellm-flaws-allow-admin-takeover-and-api-key-theft","Critical LiteLLM Flaws Allow Admin Takeover and API Key Theft","2026-10-14T12:21:48.189+00:00",{"slug":44,"title":45,"published_at":46},"critical-ghostscript-flaw-enables-rce-via-malicious-pdf-uploads","Critical Ghostscript Flaw Enables RCE via Malicious PDF Uploads","2026-10-13T22:20:31.668+00:00",{"slug":48,"title":49,"published_at":50},"google-adjusts-chrome-bug-bounty-rewards-amid-ai-driven-threat-evolution","Google Adjusts Chrome Bug Bounty Rewards Amid AI-Driven Threat Evolution","2026-10-13T18:20:47.688+00:00",{"slug":52,"title":53,"published_at":54},"adobe-releases-massive-140-vulnerability-patch-batch-across-10-products","Adobe Releases Massive 140-Vulnerability Patch Batch Across 10 Products","2026-10-13T18:20:31.404+00:00",{"slug":56,"title":57,"published_at":58},"critical-gitlab-rce-flaw-demands-immediate-patching","Critical GitLab RCE Flaw Demands Immediate Patching","2026-10-12T14:21:04.504+00:00",{"slug":60,"title":61,"published_at":62},"cvss-100-wordpress-plugin-flaw-exploited-for-unauthenticated-rce","CVSS 10.0 WordPress Plugin Flaw Exploited for Unauthenticated RCE","2026-10-12T10:20:52.562+00:00",{"slug":64,"title":65,"published_at":66},"ai-augmented-cyberxero-campaign-exfiltrates-628000-ukrainian-records","AI-Augmented CyberXero Campaign Exfiltrates 628,000+ Ukrainian Records","2026-10-12T08:20:22.332+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",99,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",82,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",75,{"slug":84,"name":85,"problem":86,"stories":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",60,{"slug":89,"name":90,"problem":91,"stories":92},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",38,{"slug":94,"name":95,"problem":96,"stories":97},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",25,[99,105,111,116,121,127,132,138],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","2","Control 2","Inventory and Control of Software Assets",150,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",110,{"family":100,"item":112,"code":113,"title":114,"together":115},"7","Control 7","Continuous Vulnerability Management",96,{"family":100,"item":117,"code":118,"title":119,"together":120},"16","Control 16","Application Software Security",92,{"family":122,"item":123,"code":124,"title":125,"together":126},"gdpr","32","Article 32","Security of processing",84,{"family":128,"item":129,"code":130,"title":131,"together":82},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":133,"item":134,"code":135,"title":136,"together":137},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",72,{"family":106,"item":139,"code":140,"title":141,"together":142},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",70]