CWE (Common Weakness Enumeration)
CWE (Common Weakness Enumeration) is a community-developed, MITRE-maintained catalog of software and hardware weakness types, each with a unique identifier like CWE-79, that gives the industry a common language for classifying the root causes of vulnerabilities.
CWE, the Common Weakness Enumeration, is a formal, hierarchical dictionary of common weakness types in software and hardware, maintained by MITRE with community input. Each entry has a stable identifier, such as CWE-79 for cross-site scripting or CWE-89 for SQL injection, along with a description, examples, and relationships to related weaknesses.
A weakness is a flaw or mistake in code, design, or architecture that can lead to a vulnerability; CWE catalogs those root-cause categories, while a CVE identifies a specific vulnerability in a specific product. Security tools, standards, and vulnerability reports reference CWE IDs so that findings can be grouped, compared, and mapped consistently across different vendors and datasets.
For developers, CWE turns a vague finding into an actionable category with guidance and mitigations. Curated views like the CWE Top 25 Most Dangerous Software Weaknesses highlight the most impactful and prevalent weaknesses, helping teams focus remediation and secure-coding efforts where they matter most.