In web dev there is the OWASP top 10, which is made of relatively old but still widespread vulnerabilities, right?