CWE

CWE, the Common Weakness Enumeration, is a community-developed taxonomy of software and hardware weakness types, maintained by MITRE under sponsorship from the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA). A weakness, in CWE's own definition, is a condition in software, firmware, hardware, or a service component that could, under certain circumstances, contribute to a vulnerability.

The current version, CWE 4.20, catalogs 944 distinct weakness types.

What does CWE stand for?

CWE stands for Common Weakness Enumeration.

First published in 2006, it's one of the older, more established vulnerability-classification efforts in the industry, and it updates three to four times a year through an open Content Development Repository on GitHub, where community partners can propose and review new entries before publication.

Why CWE matters

A vulnerability report that just says "insecure storage" or "injection flaw" means something slightly different to every reader. CWE exists to close that gap.

Instead of a prose description that varies by whoever wrote the finding, a report can cite CWE-312 (Cleartext Storage of Sensitive Information) or CWE-89 (SQL Injection) and mean the exact same thing regardless of who's reading it or which tool found it.

That shared vocabulary is why CWE sits underneath so much else in the industry.

CVE entries get tagged with CWE IDs, the annual CWE Top 25 ranks the most dangerous weakness types by real-world prevalence, and OWASP's own Top Ten has been mapped to CWE identifiers going all the way back to its 2004 edition.

CWE vs. CVE

These two get confused constantly. Both are MITRE-sponsored, both use similar-looking numbered identifiers, and the confusion is understandable.

CVE (Common Vulnerabilities and Exposures) catalogs specific, individual vulnerabilities found in specific products and versions. CVE-2021-44228, the Log4Shell vulnerability in Apache Log4j, is one CVE entry describing one flaw in one piece of software.

CWE catalogs the types of weakness that make vulnerabilities like that possible in the first place. CVE-2021-44228 is tagged to CWE-502 (Deserialization of Untrusted Data), because that's the general category of mistake that made Log4Shell exploitable.

The relationship, in short: CWE describes the category of mistake. CVE describes one specific, real-world instance of a vulnerability that resulted from it.

How CWE is organized

The full list is navigable through several structured views, three of which serve as the primary hierarchies:

• Software Development (CWE-699): weaknesses organized around concepts encountered during software development.
• Hardware Design (CWE-1194): weaknesses specific to hardware design.
• Research Concepts (CWE-1000): organizes weaknesses by underlying behavior, built for research use.

Beyond these, CWE maintains dozens of narrower, purpose-built views: by programming language (C, C++, Java, PHP), by external mapping (the CWE Top 25, OWASP Top Ten, SEI CERT coding standards), and, notably for mobile teams, a dedicated Weaknesses in Mobile Applications view.

Where mobile fits into CWE

CWE-919, the Weaknesses in Mobile Applications view, groups the weakness types most relevant to mobile apps specifically, pulled out from the broader 944-entry list into a mobile-focused slice. It's a useful starting point for a mobile team that doesn't need the full catalog's hardware and general web-application entries cluttering the view.

Where Appknox fits

Appknox tags every finding from binary SAST, AI-led DAST, and API security testing with the specific CWE ID it corresponds to, not just a proprietary severity label. That gives a finding a citable, industry-standard classification that an auditor or a second security team can independently verify, rather than one vendor's internal taxonomy.

See the full testing methodology: Appknox Automated Vulnerability Assessment.

Frequently asked questions

What does CWE stand for?

CWE stands for Common Weakness Enumeration, MITRE's community-developed taxonomy of software and hardware weakness types.

What's the difference between CWE and CVE?

CWE describes categories of weakness, the type of mistake. CVE describes specific, individual vulnerabilities found in specific products. A single CVE entry is typically tagged with one or more CWE IDs describing what kind of weakness caused it.

How many weaknesses does CWE currently list?

The current version, CWE 4.20, catalogs 944 distinct weakness types.

How often is CWE updated?

Three to four times per year, through an open, GitHub-based content development process.

Does CWE have a mobile-specific view?

Yes. CWE-919, Weaknesses in Mobile Applications, groups the entries most relevant to mobile apps specifically.

Does Appknox map findings to CWE?

Yes. Appknox tags every finding from its binary SAST, AI-led DAST, and API security testing with the specific CWE ID it corresponds to.

Related: What is OWASP Mobile Top 10? | What is MASVS? | Appknox Automated Vulnerability Assessment

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience mapping automated and manual testing findings to CWE and OWASP Mobile Top 10 categories across financial services, healthcare, and enterprise mobile app portfolios.

This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.