CWE
acronymsecuritygovernance & risk
Stands for: Common Weakness Enumeration
A community catalog of software weakness types, each with a stable identifier like CWE-787.
The distinction from CVE is the one to hold: a CVE is one specific vulnerability in one specific product, while a CWE is the category of mistake behind it, so a CVE report says what broke and its CWE says why. MITRE publishes the CWE Top 25 most dangerous weaknesses annually, which is the register the memory-safety classes keep appearing on. It is the vocabulary secure-code reviews and static analysis tools report in.
CWE catalogues weakness types rather than individual vulnerabilities: the class of mistake, such as improper input validation or use after free, as opposed to CVE's naming of a specific instance in a specific product. The pairing is that a CVE is an occurrence and its CWE is the reason.
That distinction is what makes CWE useful for prevention rather than response. A list of CVEs tells you what to patch; a distribution of CWEs tells you what your development process keeps producing, which is actionable in a different way. The Top 25 is the widely cited artefact, and it is more useful read as a curriculum for where to invest in training and tooling than as another checklist.
Also known as: Common Weakness Enumeration, CWE Top 25