CWE, the Common Weakness Enumeration, is a community-developed catalog of common software and hardware weaknesses. It describes conditions that could lead to vulnerabilities under certain circumstances, and it organizes them in a classification taxonomy. CWE names the type of flaw. A CVE names one specific instance.
Who maintains it
CWE is sponsored by the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, CISA. It is managed by the Homeland Security Systems Engineering and Development Institute, which is operated by The MITRE Corporation. Partners from government, industry and academia contribute through working groups and special interest groups.
Weakness versus vulnerability
The distinction trips people up, so a simple picture helps.
- A weakness is a kind of mistake, such as building a database query by gluing user input into a string.
- A vulnerability is a particular place where that mistake exists in a particular product and can be exploited.
One weakness type can show up in thousands of separate products. Each product flaw gets its own record, and the record can point at the weakness type it belongs to. The source page for CWE does not describe the CVE link itself, so check the vulnerability record you are reading to see which weakness it lists.
What you can do with CWE
CWE is most useful in aggregate.
- Group your findings by weakness type to see patterns. Twenty findings of one type usually mean one habit, not twenty accidents.
- Aim training and code review at the weakness types you actually produce.
- Set coding standards and automated checks against specific entries.
- Ask static analysis vendors which entries their rules cover, and compare the answers.
A caution on counting
Weakness counts show what your tools detect and how entries are assigned, not the true state of your code. A type that never shows up may simply have no detector. Use counts to find questions, not to declare victory.
Safeguard's code and dependency scanning report findings you can group and track. A free scan is at gold.safeguard.sh/scan. For the exploitation side of the picture, see the KEV catalog.
Quick check
Is a CWE the same as a CVE?
No. A CWE is a category of weakness. A CVE identifies one specific vulnerability in one product.
Does CWE cover hardware?
Yes. The catalog covers common software and hardware weaknesses.
Sources
Last reviewed: 19 October 2026.
