CWE

Common Weakness Enumeration is a community list of software and hardware weakness types, maintained by MITRE. Where a CVE names one specific flaw in one specific product, a CWE names the category of mistake that made it possible.

Some common identifiers: CWE-79 (cross-site scripting), CWE-89 (SQL injection), CWE-22 (path traversal), CWE-787 (out-of-bounds write), CWE-502 (deserialization of untrusted data). CWEs are organised in a hierarchy, from broad categories down to very specific weaknesses.

Each year MITRE publishes, with CISA's support, the CWE Top 25 ranking of the most dangerous weaknesses. For defenders, CWE helps spot the bug classes that keep coming back in a product, and focus code reviews and testing.