OWASP has released a revised version of its Top 10 list of critical risks to web applications, adding two new categories.