OWASP Top 10 is subjective to a certain extent, because it is consensus-based. At the same time, it is very useful to most developers and pen testers (and security tool makers), in preparing a list of vulnerabilities to check for. Consider it as a starting point.

With cloud platforms rising in popularity, the top two rising to those spots is not surprising. From a cursory glance, they seem to have added more scenarios under those two as well.