I'm familiar with the OWASP top 10, for web applications. Is there something simular for BizTalk applications?
The OWASP Top 10 is not language specific; it is applicable for all web applications. The CWE Top 25 is the most generally used list for non-web applications. That's probably what you're looking for.
If you want something language specific, it'd be most helpful to look for a biztalk security guidance or a BizTalk hardening guide and also to obey common practices like treating all user input as malicious.