CWE

securitygovernance & risk

Stands for: Common Weakness Enumeration

A community catalog of software weakness types, each with a stable identifier like CWE-787.

The distinction from CVE is the one to hold: a CVE is one specific vulnerability in one specific product, while a CWE is the category of mistake behind it, so a CVE report says what broke and its CWE says why. MITRE publishes the CWE Top 25 most dangerous weaknesses annually, which is the register the memory-safety classes keep appearing on. It is the vocabulary secure-code reviews and static analysis tools report in.

Also known as: Common Weakness Enumeration, CWE Top 25

← All glossary entries