Common Weakness Enumeration (CWE) is a community-developed list of common software and hardware weaknesses. A weakness is a condition in a software, firmware, hardware or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities. Each type of weakness gets its own entry, so builders and testers can use the same names for the same kinds of mistake.
- Also Called3other namesCommon Weakness Enumeration · CWE list · CWE ID
- Related Terms3linked entriesVulnerability management
What Is CWE?
CWE stands for Common Weakness Enumeration. The CWE program describes it as a community-developed list of common software and hardware weaknesses. It defines a weakness as a condition in a software, firmware, hardware or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities.
NIST glossary entries describe CWE as a taxonomy for identifying the common sources of software flaws, with buffer overflows and failure to check input data as examples. A taxonomy is an organized system of categories. Another NIST entry calls it a list of known poor coding practices that may be present in software.
How Does CWE Work?
Each type of weakness gets its own entry in the list, so builders and testers can use the same names for the same kinds of mistake. The CWE site says the goal is to help developers and designers identify and eliminate weaknesses before deployment. It says this is much easier and cheaper than dealing with vulnerabilities after release.
CWE says it is sponsored by the United States Cybersecurity and Infrastructure Security Agency (CISA). It says the program is managed by the Homeland Security Systems Engineering and Development Institute, which is operated by The MITRE Corporation.
Why Does It Matter?
A weakness is the root cause, and a vulnerability is what can follow from it. If a team knows the weakness types it keeps producing, it can look for them earlier, in design and review. The CWE program says it publishes an annual list of the most dangerous weaknesses, which can help teams decide where to look first. Using common names can also make code reviews, test reports and training easier to compare.
How Can You Use CWE to Reduce Risk?
CWE is a reference list, so the benefit comes from how you use it. These are general ideas drawn from the stated goal.
- Use CWE names when you write down findings from code review or testing.
- Check the annual list of most dangerous weaknesses when you plan reviews and training.
- Look for the same weakness type across your code, not only the single flaw that was reported.
These are general habits and not a full program.
Which Weaknesses Rank Highest on the 2025 CWE Top 25?
MITRE built the 2025 CWE Top 25 Most Dangerous Software Weaknesses from 39,080 CVE Records published between 1 June 2024 and 1 June 2025. The table shows nine of the 25 entries, the ones that match a page on this site. The KEV column is MITRE’s count of CVEs of that weakness type in the CISA Known Exploited Vulnerabilities catalog. The last column links a page on this site that names the same weakness.
| Rank | CWE | Weakness | CVEs in KEV | Example on this site |
|---|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting | 7 | Cross-site scripting (XSS) |
| 2 | CWE-89 | SQL Injection | 4 | CVE-2023-34362, MOVEit Transfer |
| 4 | CWE-862 | Missing Authorization | 0 | CVE-2026-103799, Dell PowerProtect Data Domain |
| 5 | CWE-787 | Out-of-bounds Write | 12 | CVE-2024-21762, FortiOS SSL VPN |
| 6 | CWE-22 | Path Traversal | 10 | CVE-2024-57727, SimpleHelp |
| 9 | CWE-78 | OS Command Injection | 20 | CVE-2026-1731, BeyondTrust Remote Support |
| 12 | CWE-434 | Unrestricted Upload of File with Dangerous Type | 4 | CVE-2024-50623, Cleo Harmony |
| 15 | CWE-502 | Deserialization of Untrusted Data | 11 | CVE-2025-53770, SharePoint |
| 21 | CWE-306 | Missing Authentication for Critical Function | 11 | CVE-2024-47575, FortiManager |
Rank and KEV count measure different things. CWE-862 ranks fourth with no KEV entries in this data, while CWE-78 ranks ninth with 20. For a walk through the full list, read our post on the 2025 CWE Top 25.
How Do You Map a CVE to a CWE?
MITRE publishes root cause mapping guidance for people who write or analyze CVE Records. It separates the weakness, which is the cause, from phrases like “gain privileges”, which describe the result. The steps below follow that guidance.
- Describe the cause, not the impactUse weakness language such as “missing authentication” or “improper bounds check”, not “gain privileges”.
- Search the CWE listSearch by keyword or by a known CWE ID. The MITRE example for “xss” leads to CWE-79.
- Prefer Base or Variant entriesMITRE says these give enough specificity and root cause detail. Use a Class entry only if no accurate Base or Variant exists.
- Read the mapping label and notesEach CWE shows a usage label: Allowed, Allowed with careful review, Discouraged or Prohibited. Read its Mapping Notes too.
- Never map to a CategoryMITRE says a vulnerability must not be mapped to a CWE Category. It also advises checking the mapping with a colleague.
Is a CWE the Same as a CVE?
No. A CWE names a type of weakness, such as a kind of coding mistake. A CVE names one specific publicly known vulnerability in a specific product. In simple terms, CWE is the kind of mistake and CVE is one real case.
Is a CWE the Same as a Vulnerability?
No. The CWE program says a weakness could contribute to the introduction of vulnerabilities. A weakness alone is not always a flaw that attackers can use. Related terms are CVE and vulnerability management.
Related Pages in the Knowledge Hub
Sources
- MITRE CWE: CWE is a community-developed list of common software and hardware weaknesses; defines a weakness; goal is to eliminate weaknesses before deployment; sponsored by CISA….
- NIST: NIST glossary describes CWE as a taxonomy for identifying common sources of software flaws and as a list of known poor coding practices.
- MITRE CWE: the 2025 CWE Top 25 ranks, weakness names and CVEs in KEV counts shown in the table.
- MITRE CWE: the 2025 dataset of 39,080 CVE Records published between 1 June 2024 and 1 June 2025.
- MITRE CWE: the CVE to CWE root cause mapping guidance behind the mapping steps.
Also Called.
- NameCommon Weakness Enumeration
- NameCWE list
- NameCWE ID
Questions.
-
What does CWE stand for?
CWE stands for Common Weakness Enumeration. The CWE program describes it as a community-developed list of common software and hardware weaknesses, with its own entry for each type of weakness so builders and testers use the same names.
-
What is the difference between CWE and CVE?
A CWE names a type of weakness, such as a kind of coding mistake. A CVE names one specific publicly known vulnerability in a specific product. In simple terms, CWE is the kind of mistake and CVE is one real case.
-
Who runs the CWE list?
CWE says it is sponsored by the United States Cybersecurity and Infrastructure Security Agency (CISA). It says the program is managed by the Homeland Security Systems Engineering and Development Institute, which is operated by The MITRE Corporation.
-
How can teams use CWE to reduce risk?
Use CWE names when you write down findings from code review or testing. Check the annual list of most dangerous weaknesses when you plan reviews and training. Look for the same weakness type across your code, not only the single flaw that was reported.
-
Which weaknesses top the 2025 CWE Top 25?
MITRE ranks CWE-79 cross-site scripting first, CWE-89 SQL injection second and CWE-352 cross-site request forgery third. The list uses 39,080 CVE Records published between 1 June 2024 and 1 June 2025.
In Our Research
- 1 2025 CWE Top 25: Most Dangerous Software Weaknesses October 2026
- 2 The Most Affected Products by Vulnerabilities October 2022
- 3 Common Vulnerabilities and Exposures (CVE) Glossary term
- 4 Remote code execution (RCE) Glossary term
- 5 Vulnerability intelligence Glossary term