A03:2025 Software Supply Chain Failures
Vulnerable, outdated, or compromised dependencies, build pipelines, and signing infrastructure. Expanded from 2021's 'Vulnerable and Outdated Components'.
Related on the LLM side: OWASP Top 10 for LLMs LLM03:2025.
Member CWEs (6)
- CWE-447 Unimplemented or Unsupported Feature in UI
- CWE-477 Use of Obsolete Function
- CWE-1035
- CWE-1104 Use of Unmaintained Third Party Components
- CWE-1329 Reliance on Component That is Not Updateable
- CWE-1395 Dependency on Vulnerable Third-Party Component
Mapped NIST 800-53 r5 controls (51)
Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
AU-6←PCA-2←PCA-2.1←PCA-5←PCA-7←PCA-7.1←PCA-7.4←PCM-14←PCM-2.2←PCM-3←PCM-6←P →PCM-7←PCM-7.1←PCM-8←PCM-8.3←PCM-9←PCP-10←PIR-4←PIR-5←PMA-2←PMA-3←PMA-3.1←PMA-6←PRA-3←PRA-3.1←PRA-5←PRA-5.11←PRA-5.2←PRA-7←PSA-10←PSA-11←PSA-15←PSA-22←P →MSA-3←PSA-9←PSI-2←P →PSI-2.2←PSI-3←PSI-4←PSI-4.2←PSI-4.4←PSI-4.5←PSI-5←PSI-7←PSI-7.1←PSR-10←PSR-11←PSR-2←PSR-3←MSR-6←PSR-8←P
Tagged CVEs (showing 50 most recent of 68)
- CVE-2026-93579
- CVE-2026-93578
- CVE-2026-93575
- CVE-2026-93566
- CVE-2026-93565
- CVE-2026-93564
- CVE-2026-93563
- CVE-2026-93562
- CVE-2026-93561
- CVE-2026-93560
- CVE-2026-93558
- CVE-2026-93494
- CVE-2026-93492
- CVE-2026-82935
- CVE-2026-66788
- CVE-2026-60368
- CVE-2026-56580
- CVE-2026-48576
- CVE-2026-48573
- CVE-2026-41468
- CVE-2026-41097
- CVE-2026-21821
- CVE-2026-21753
- CVE-2026-21752
- CVE-2026-21265
- CVE-2026-16634
- CVE-2026-12554
- CVE-2026-11325
- CVE-2026-3031
- CVE-2026-1693
- CVE-2025-55277
- CVE-2025-52658
- CVE-2025-49220
- CVE-2025-49219
- CVE-2025-49217
- CVE-2025-49216
- CVE-2025-49214
- CVE-2025-49213
- CVE-2025-49212
- CVE-2025-48862
- CVE-2025-40906
- CVE-2025-34193
- CVE-2025-34192
- CVE-2025-20010
- CVE-2025-12104
- CVE-2025-10220
- CVE-2025-3497
- CVE-2024-39533
- CVE-2024-35252
- CVE-2024-21631
Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1438).