CWE
CWE · Common Weakness Enumeration · CWE Top 25 · software weakness · weakness type
A public catalogue of the types of design and coding mistakes that cause vulnerabilities, each type carrying a number (for example CWE-89 for SQL injection).
In practice
A CVE identifies one specific flaw in one specific product; a CWE identifies the family of mistakes that made it possible. The list, developed with the community, is managed by MITRE and sponsored by CISA; it covers both software and hardware and is updated three to four times a year. Every year MITRE publishes the CWE Top 25 Most Dangerous Software Weaknesses: the 2025 edition, based on 39,080 CVEs, is topped by cross-site scripting (XSS, CWE-79), SQL injection (CWE-89) and cross-site request forgery (CWE-352). SAST tools and penetration test reports classify findings by CWE, which reveals a team’s recurring mistakes.
Fictional case: a team notices that most of its vulnerabilities this year fall under two CWEs, CWE-79 and CWE-862 (missing authorisation). It focuses its training and static analysis rules on those two families, and the matching findings drop from the next quarter.
