Some other data:
The OWASP Business Logic Abuse Top 10, released this year, formalizes this growing class of attacks. And with 82% of businesses now describing themselves as API-first, the logic layer has become a lucrative new target.
Security Misconfiguration (API8) once again topped the list with 605 cases, up 33% quarter over quarter.
Broken Authorization (API5, API1) accounted for roughly 28% of all API vulnerabilities.
Broken Authentication (API2) climbed sharply, driven by weak credential enforcement in REST and SOAP APIs.