OWASP Top Ten
A periodically updated consensus list of the most critical web application security risks, useful as a design-review checklist.
Its value to an architect is as a structured prompt during design review, not as a vulnerability scanner's output. Several entries are architectural rather than coding issues and cannot be fixed after the fact.
The ones that are design decisions: broken access control (the perennial number one — usually missing object-level checks, which is a question of where authorisation is enforced), insecure design (added precisely to capture flaws that no amount of secure coding fixes), security misconfiguration, vulnerable and outdated components (a supply-chain and patching-pipeline question), and SSRF (a network egress design question).
There is a separate API Security Top Ten, which is the more relevant list for a service-to-service estate; its top entries are object-level and function-level authorisation failures, which reinforces the same point.