What Is Common Weakness Enumeration?
Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware weakness types, maintained by MITRE. Each entry, such as CWE-79 for cross-site scripting, describes a kind of mistake that can lead to vulnerabilities.
Also known as:
CWE vs CVE
The two are easy to mix up. A CWE describes a type of weakness, such as improper input validation or a missing authorization check. A CVE identifies a specific vulnerability in a specific product. Many CVE records are mapped to the CWE that caused them, which is how teams spot patterns in the mistakes behind their vulnerabilities.
How CWE Is Organized
CWE entries form a hierarchy, from broad categories down to specific weaknesses, and are grouped into views for different audiences such as software developers or hardware designers. Each entry includes a description, common consequences, examples and mitigations.
The CWE Top 25
MITRE publishes the CWE Top 25 Most Dangerous Software Weaknesses, a ranking based on how often weaknesses appear in real vulnerability data and how severe they tend to be. Injection, cross-site scripting, out-of-bounds memory errors and missing authorization checks regularly appear near the top.
How Teams Use CWE
- Classify findings. Scanners tag results with CWE IDs so they can be grouped and compared across tools.
- Find root causes. Recurring CWEs point to gaps in training, frameworks or code review.
- Plan remediation. Fixing a whole class of weakness at once is often more efficient than fixing findings one by one.
How Nullify Uses CWE
Nullify campaigns can target findings by CWE as well as by CVE, repository, team or severity, so a security team can set an objective such as eliminating a weakness class across the codebase and track it to completion. See how Nullify campaigns work.
Key Takeaways
- CWE catalogs types of weaknesses, while CVE identifies specific vulnerabilities.
- Each CWE entry includes consequences, examples and mitigations.
- The CWE Top 25 ranks the most common and severe software weaknesses.
- Grouping findings by CWE helps fix root causes, not just individual bugs.
Read More About Common Weakness Enumeration
Program Management
See Nullify in Action
Nullify can run a campaign to remove a whole weakness class across your code.