Cybersecurity glossary
What is Common Weakness Enumeration (CWE)?
Learn what CWE is, how weakness IDs differ from CVEs, how CWE Top 25 and mappings help secure coding, and how to use CWE in design reviews and scanner triage.
Definition
Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware weakness types—reusable categories such as SQL injection or buffer overflow—that explain *why* vulnerabilities happen, independent of any single product instance.
Why weakness types beat one-off bug names
CVE IDs tell you which product flaw to patch. They do not teach an engineering org how to stop inventing the same class of bug. Common Weakness Enumeration (CWE) catalogs those classes so training, SAST rules, and design reviews can target root causes.
When five tickets are all CWE-89, you do not need five unrelated “critical” stories—you need parameterized queries as a standard.
How CWE fits the vulnerability lifecycle
A concrete bug is found
Testing, hunting, or a scanner identifies a vulnerability in code or a dependency.
Analysts map it to a CWE
The issue is classified by weakness type (injection, authz gap, memory error, crypto misuse).
CVE may be assigned for instances
Product-specific public flaws get CVE IDs that often reference their CWE mapping.
Controls target the weakness pattern
Secure coding standards, libraries, and architecture rules address the CWE class.
Metrics track recurring CWEs
Teams watch which weakness IDs keep returning after “fixes.”
Useful ways to group CWE concepts
Base weaknesses
Concrete flaw types such as XSS, path traversal, or integer overflow.
Pillars / categories
Higher-level groupings that organize related weaknesses for navigation.
View slices
Curated perspectives (Top 25, research views) for prioritization and education.
Hardware CWEs
Weakness types spanning firmware and chip designs beyond classic app bugs.
CWE vs neighboring catalogs
| Catalog | Answers |
|---|---|
| CWE | What kind of weakness is this? |
| CVE | Which specific public vulnerability is this? |
| CVSS | How severe is this instance technically? |
| CAPEC | What attack patterns abuse this weakness? |
| ATT&CK | How do adversaries behave after exploitation? |
- Require CWE IDs on SAST/DAST findings and security review tickets.
- Build secure-coding guidance keyed to the CWE IDs your stack actually hits.
- Use CWE Top 25 as a curriculum baseline, then customize for your languages.
- When remediating, fix the pattern (library helpers, linters) not only one line.
- Track recurring CWE rates per team as a quality signal alongside CVE SLAs.
- Challenge vague labels like “security bug”—demand a CWE or equivalent.
- Map third-party CVEs to CWEs when deciding whether similar first-party code is safe.
- Keep mappings updated; NVD and vendor CWE links can improve over time.
The practical takeaway
CWE names the weakness class; CVE names the instance. Score with CVSS, prioritize with exposure and exploit intel, but prevent recurrence by engineering against CWE patterns.
If the same CWE keeps appearing after patches, you are treating symptoms—not the design flaw.
Related security terms
Common Vulnerabilities and Exposures (CVE)
Instance identifiers often mapped to one or more CWE weakness types.
Common Vulnerability Scoring System (CVSS)
Severity scoring for specific CVE instances, not weakness classes.
SQL Injection (SQLi)
Classic weakness class catalogued under CWE-89.
Buffer Overflow
Memory weakness family represented by multiple CWE entries.
Remediation
Fixes often target the CWE root cause, not only one CVE symptom.
Frequently asked questions
What is CWE in simple terms?
CWE is a dictionary of bug *types*—like “SQL injection” or “missing authentication”—so teams can talk about root causes instead of only one product’s CVE.
How is CWE different from CVE?
CVE labels a specific vulnerability in a specific product version. CWE labels the underlying weakness pattern that many CVEs can share.
Who maintains CWE?
MITRE maintains the CWE list with community input, widely used by NVD, secure-coding guides, and static analysis tools.
What is the CWE Top 25?
A periodic ranking of the most dangerous and common weakness types, useful for training and control design—not a complete risk list for your stack.
Can one CVE map to multiple CWEs?
Yes. Complex bugs may involve several weakness categories, and mappings can be refined over time.
How should developers use CWE?
Map findings to CWE in code review and SAST triage, then apply the matching prevention pattern (parameterization, bounds checks, authz checks).
Does fixing a CWE remove all related CVEs?
Fixing the pattern in your code reduces future instances. Past CVEs in third-party packages still need package upgrades.
References
Explore authoritative guidance and frameworks related to common weakness enumeration (cwe).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.