Ok, but if you're drawing the line at the vulnerabilities that have gotten the most promotion and documentation and not the ones that have the most impact or prevalence, isn't your standard cosmetic? For instance: you've let developers off the hook for SSRF.
Isn't OWASP top 10 based on impact and prevalence?
In terms of ranking not in terms of seldction
Clearly not; SSRF isn’t in the top 10, but log misconfiguration is.
The OWASP Top 10 is fashion, really, nothing much more.