What Is CWE? Common Weakness Enumeration and the Top 25

CWE (Common Weakness Enumeration) is a categorized list of software and hardware weakness types: the underlying mistakes that lead to vulnerabilities. Maintained by MITRE with sponsorship from CISA, each entry has a stable ID like CWE-79 (cross-site scripting) or CWE-89 (SQL injection). A CVE names one specific vulnerability in one product; a CWE names the class of mistake behind it.

Last updated 31 October 2026.

CWE is the connective tissue of vulnerability data. Almost every enriched vulnerability record pairs a CVE ID with a CWE type, and the National Vulnerability Database (NVD) assigns a CWE to most CVEs it analyzes. The catalog is published openly at cwe.mitre.org, and its best-known artifact, the CWE Top 25 Most Dangerous Software Weaknesses, is the industry's annual shortlist of the flaw classes doing the most real-world damage. For how weakness types fit into deciding what to fix first, see our vulnerability prioritization guide.

What is the difference between CWE and CVE?

A CWE is a weakness type; a CVE is a specific instance. CWE-787 is "out-of-bounds write," a kind of coding mistake that can appear in any program. A CVE names one particular out-of-bounds write in a named product and version. One CWE maps to thousands of CVEs, and every well-analyzed CVE points back to at least one CWE.

Put simply: CVE answers "which bug," CWE answers "what kind of bug," and CVSS answers "how severe."

What is the CWE Top 25?

The CWE Top 25 is an annual, data-driven ranking by MITRE and CISA of the weakness types behind the most serious and most exploited vulnerabilities, scored by how often they appear in recent CVEs and how severe those CVEs are. The top 10 of the 2025 list:

For a web or API team, most of the top 10 are injection and access-control mistakes, exactly the classes static analysis (SAST) and code review are built to catch. Missing authorization (CWE-862) at number 4 is a common pattern in AI-generated code: endpoints that check who you are but not what you're allowed to do.

How is CWE structured?

CWE is a hierarchy, not a flat list. Weaknesses run from broad Pillars down through Classes to specific Base and Variant weaknesses, so you can talk about a problem at the level that fits. For example, CWE-119 (improper restriction of operations within a memory buffer) is a broad class containing CWE-787 (out-of-bounds write) and CWE-125 (out-of-bounds read). Each entry carries a description, consequences, mitigations and real CVE examples, which makes CWE useful for developers, not just analysts. MITRE also publishes views that slice the catalog for different audiences, including a software-development view and the Top 25.

How does CWE relate to the OWASP Top 10?

The OWASP Top 10 is a curated awareness list of web application risk categories; CWE is the full enumeration of weakness types. Each OWASP category maps to many CWEs: "Broken Access Control," for example, includes CWE-862 (missing authorization) and CWE-22 (path traversal). Security tools usually report both.

Why does CWE matter for prevention?

CVE and CVSS tell you about individual fires; CWE tells you where the fires keep starting. If the same weakness type keeps producing findings in your code, fix the pattern (add a lint rule or test, change a library, update a template), not just each instance. CWE is also how code-security tools classify what they find, so "CWE-79 in this template" maps straight to known mitigations.

CWE has a limit worth stating plainly: like CVSS, it describes a category, not your exposure. Knowing a flaw is CWE-306 (missing authentication for a critical function), as in the CVSS 10.0 Azure AI Foundry flaw, tells you the shape of the risk, not whether that function is reachable in your deployment.

How ARGUS uses CWE

ARGUS finds weakness classes like these in your own code with static analysis plus AI review, maps findings to the OWASP Top 10, reviews every pull request, and opens the smallest fix as a pull request for a person to merge. It's how flaws that will never get a CVE, because they exist only in your code, get caught before they ship. See a sample ARGUS review, which shows a missing authorization check (CWE-862) caught in a pull request.

Frequently asked questions

What does CWE stand for?

Common Weakness Enumeration, a categorized list of software and hardware weakness types maintained by MITRE.

What is a CWE ID?

A stable identifier for a weakness type, written as CWE followed by a number, such as CWE-416 (use after free) or CWE-22 (path traversal). It links a vulnerability to its root-cause category.

What is the number one CWE in 2025?

CWE-79, cross-site scripting, tops the 2025 CWE Top 25, followed by SQL injection (CWE-89) and cross-site request forgery (CWE-352).

Who maintains CWE?

The CWE Program is run by MITRE with sponsorship from CISA, and the catalog is updated with community input.

Is CWE the same as the OWASP Top 10?

No, but they're related. The OWASP Top 10 is a curated list of web application risk categories; CWE enumerates weakness types across all software and hardware. OWASP categories map to underlying CWEs.

Our read

CWE is the layer most vulnerability conversations skip, and skipping it keeps teams stuck in reaction. CVE and CVSS point at individual flaws; CWE points at the recurring mistake, which is where prevention lives. If a weakness class keeps recurring, the fix is the pattern, not the patch.

Related reading: What is a CVE? · What is a CVSS score? · What is path traversal? · Best SAST tools for startups