What is a CWE?
Common Weakness Enumeration: the catalogue of software and hardware weakness types, such as CWE-79 (cross-site scripting) or CWE-787 (out-of-bounds write).
A CVE is one specific flaw in one product; a CWE is the kind of mistake behind it. Tagging CVEs with CWEs lets teams see patterns (for example many injection bugs in one codebase) and fix the class of bug, not just one instance.
MITRE also publishes a yearly list of the most dangerous CWEs, built from recent CVE data.
Sources
Related terms
- CVECommon Vulnerabilities and Exposures: the public ID system for disclosed security flaws, written as CVE-YEAR-NUMBER, for example CVE-2021-44228.
- NVDThe National Vulnerability Database run by NIST, which republishes CVE records and adds analysis such as CVSS scores, CWE types and CPE product names.