software-supply-chain-failures
Installation
SKILL.md
Software Supply Chain Failures — OWASP A03:2025
Overview
A03:2025 is the #1 community-voted concern and the highest-risk category by exploit score in the entire OWASP Top 10:2025, despite having only 6 CWEs and limited test data:
| Metric | Value |
|---|---|
| OWASP Rank | #3 (new — expands A06:2021 "Vulnerable & Outdated Components") |
| Average Incidence | 5.72% |
| Avg Exploit Score | 8.17 (highest of any category) |
| Avg Impact Score | 5.23 (highest of any category) |
| Key CWEs | CWE-1104, CWE-1395, CWE-1329 |
Key CWEs:
- CWE-1104 — Use of Unmaintained Third-Party Components
- CWE-1395 — Dependency on Vulnerable Third-Party Component
- CWE-1329 — Reliance on Component That is Not Updateable