What the CWE List Contains
MITRE started CWE in 2006 and keeps it current with help from a community of vendors, researchers, and government agencies. The list covers weaknesses in code, design, and architecture, from missing input checks to hardcoded passwords, and it includes hardware flaws too. That breadth is the point: developers, testers, and auditors can describe the same problem with the same name. Each entry gives a name, a plain description, the languages and technologies it affects, the typical impact, example code, and ways to prevent or detect it. The current release is CWE List version 4.20. CWE is free to use, which is why NVD, scanners, and compliance frameworks all reference its IDs instead of inventing their own labels.
CWE vs CVE vs CVSS
These three standards get mixed up because they appear side by side in advisories. They answer different questions, and each one feeds the next. A weakness is the root cause, a vulnerability is one real instance of it, and a score says how bad that instance is. The CVE record for a flaw usually lists its CWE, and NVD adds the CVSS score. One CWE can sit behind thousands of CVEs, which is why fixing the weakness pays off. Our stance: read the CWE first and the score second, because the weakness tells you what to change in the code, while the score only tells you how urgent the ticket is.
| Standard | What it identifies | Example | Maintained by |
|---|---|---|---|
| CWE | A type of weakness | CWE-89, SQL injection | MITRE |
| CVE | One vulnerability in one product | CVE-2021-44228, Log4Shell | CVE Program, run by MITRE |
| CVSS | The severity of a vulnerability | 10.0, Critical | FIRST |
How CWE Is Organized
CWE arranges weaknesses in a hierarchy, from abstract ideas down to specific cases. MITRE defines four levels of abstraction:
- Pillar entries are the most abstract. They describe a broad theme, such as improper control of a resource.
- Class entries describe a weakness without tying it to a language or technology, such as CWE-74, Injection.
- Base entries are specific enough to detect and prevent, yet still independent of one technology. CWE-79, cross-site scripting, is a base weakness.
- Variant entries apply to one language, framework, or context, such as CWE-83, script injection in HTML attributes.
Categories and views then group these entries for different readers, for example by programming language or by the OWASP Top 10.
Common CWE Examples
Five weaknesses account for a large share of the flaws that security teams see every week. The table shows each one with its rank in the 2025 CWE Top 25 and the number of CVEs from that list that are in the CISA KEV catalog. Use it as a map from the CWE ID in a report to the guide that explains the fix. Use after free and path traversal lead the KEV column, because attackers favour flaws that give them code execution or file access on a server, while CSRF has no KEV entries in this ranking even though it ranks third.
| CWE | Weakness | 2025 rank | CVEs in KEV | Guide |
|---|---|---|---|---|
| CWE-79 | Cross-site scripting | 1 | 7 | What is XSS |
| CWE-89 | SQL injection | 2 | 4 | Test for SQL injection |
| CWE-352 | Cross-site request forgery | 3 | 0 | What is CSRF |
| CWE-22 | Path traversal | 6 | 10 | MITRE entry |
| CWE-416 | Use after free | 7 | 14 | Use after free |
CWE Top 25 and the OWASP Top 10
The CWE Top 25 is a yearly ranking of the most dangerous software weaknesses. MITRE and CISA build it from real data: the 2025 edition scored weaknesses by how often and how severely they appear in 39,080 CVE records published between June 2024 and June 2025. Cross-site scripting held first place, followed by SQL injection and CSRF. The OWASP Top 10 is a different list. It ranks web application risk categories, and each category maps to several CWE IDs, so the two lists overlap but never match one to one. Use the Top 25 for code review priorities and the OWASP Top 10 for web application risk reporting.
How Scanners Use CWE IDs
A scanner finding without a CWE is hard to act on, because developers cannot search for it and auditors cannot map it. Here is what a CWE ID does for each reader of a scan report:
- Label every finding with its weakness type, so “SQL injection on /search” and “SQL injection on /login” group under CWE-89.
- Link the finding to the MITRE entry, which holds remediation advice and code examples developers can follow.
- Group results by CWE to find the pattern behind many findings, then fix the shared cause once.
- Map findings to compliance controls and to the OWASP Top 10 without a manual lookup.
- Compare scans over time, because a CWE count that falls shows secure coding is working.
How to Find the CWE of a CVE
Most CVE records already carry their CWE, so the lookup takes a minute:
- Open the CVE in the National Vulnerability Database and read the Weakness Enumeration section, which lists the CWE ID and its source.
- Check the record on CVE.org, where the CVE Numbering Authority often lists the problem type.
- Search the ID on cwe.mitre.org to read the weakness, its consequences, and how to prevent it.
- Expect some records to show “NVD-CWE-Other” or “NVD-CWE-noinfo”, which means no specific CWE fits yet.
Frequently Asked Questions
Is CWE a list of vulnerabilities?
No. CWE lists weakness types, the kinds of coding and design mistakes that cause vulnerabilities. A list of specific vulnerabilities in named products is the CVE List. One CWE entry can be the root cause of many different CVE records.
Who maintains CWE?
MITRE runs the CWE program as a community project, with input from vendors, researchers, and government agencies. CISA and MITRE also publish the CWE Top 25 together each year.
What is the CWE Top 25?
The CWE Top 25 is a yearly ranking of the most dangerous software weaknesses. It scores each weakness by how often it appears in published CVEs and how severe those CVEs are. In 2025, cross-site scripting ranked first.
Does a CWE ID tell me how severe a flaw is?
No. A CWE ID names the type of weakness only. For severity, read the CVSS score. For urgency, check EPSS and whether the CVE is on the CISA KEV list.
Related terms: CVE, CVSS, and CISA KEV. Sources: the MITRE CWE FAQ and the 2025 CWE Top 25.
A website vulnerability scanner tags every finding with its CWE ID, so your developers know which weakness to fix. Rank your CVEs with the free CVE Priority Checker to see which ones to patch first.
