CWE — Common Weakness Enumeration

Security · Classification
Definition

CWE (Common Weakness Enumeration) is a catalog of software and hardware weakness types maintained by MITRE. Where CVEs are specific vulnerabilities in specific products, CWEs are the categories of weakness that lead to those vulnerabilities. CWE-79 is Cross-Site Scripting, CWE-89 is SQL Injection, CWE-502 is Deserialization of Untrusted Data. A CVE will often reference the CWE that explains why the vulnerability exists.

CWE vs CVE — what's the difference

Think of CWEs as the root causes and CVEs as the instances. CWE-502 (Deserialization of Untrusted Data) is the weakness category. CVE-2021-44228 (Log4Shell) is a specific instance of that weakness in Apache Log4j.

CVEs describe what happened. CWEs describe why it happened and how to prevent the whole class of issue.

The most important CWEs for dependency security

Paste your manifest — get a fixed version with all CVEs patched in seconds.

Open PackageFix →

Free · No signup · No CLI · Runs in your browser

Common questions

Do I need to know CWEs to use PackageFix?
No — PackageFix shows CVE IDs and severity. CWEs are useful background knowledge for understanding why a class of vulnerabilities keeps recurring in certain types of libraries.
Where can I look up CWEs?
cwe.mitre.org has the full catalog. Individual CVE pages on NVD and OSV often reference the relevant CWE.
What is the difference between CWE and OWASP Top 10?
OWASP Top 10 lists the most critical web application security risks (like Injection, Broken Authentication). CWEs are the underlying technical weakness classifications. Many OWASP Top 10 categories map to multiple CWEs.
Which CWE covers supply chain attacks?
Supply chain attacks don't have a single CWE — they involve multiple weaknesses. CWE-1357 (Reliance on Insufficiently Trustworthy Component) covers the conceptual failure. Specific attack techniques use other CWEs — code injection (CWE-94), malicious dependency (CWE-829).

Related