A10 and A9: API and Component Attacks OWASP Top 10 list items 10 and 9 are exploits of APIs and components of web applications.