Skip to content
Edition of Sunday, October 25, 2026
Daily CISO

The five-minute briefing for security leaders.

Glossary

What is CWE? Common Weakness Enumeration and how it maps to CVEs

CWE is the community list of software and hardware weakness types behind CVEs. How it differs from CVE, the 2025 Top 25, and what a patch desk does with CWE IDs.

Term: Common Weakness Enumeration (CWE)Also: CWE, CWE ID, CWE Top 25Published October 19, 2026Last reviewed October 19, 2026Daily CISO Desk5 sources

Common Weakness Enumeration (CWE) is a community-developed list of the types of weakness in software and hardware that can lead to vulnerabilities, such as cross-site scripting or path traversal. It is sponsored by CISA and managed by a MITRE-operated institute. A CVE can be tagged with a CWE ID, which tells a team what class of mistake produced the flaw.

Weakness versus vulnerability

The CWE Program defines a weakness as a condition in a software, firmware, hardware or service component that could, under certain circumstances, contribute to a vulnerability. A CVE names one flaw in one product; a CWE names the pattern. In the KEV catalog, the ProFTPD flaw CVE-2015-3306 carries CWE-284, improper access control.

NVD maps weaknesses from a defined subset, the CWE-1003 view, chosen with the CWE team for mapping published vulnerabilities. When the CNA that assigned the CVE supplies its own CWE, the NVD detail page shows it alongside NVD's mapping.

The Top 25 and the KEV view

The 2025 CWE Top 25 Most Dangerous Software Weaknesses list ranks the weaknesses behind 39,080 CVE Records in that year's dataset. The 2025 ranking puts cross-site scripting (CWE-79) first, SQL injection (CWE-89) second and cross-site request forgery (CWE-352) third. A companion list ranks actively exploited weaknesses using CISA's KEV catalog.

What a patch desk does with it

A CWE ID does not change a patch deadline; KEV status, exposure and severity do. Its value is the pattern. When one weakness class keeps recurring in a product line's KEV entries, the question moves from patching to the product itself. In October 2026 the catalog listed path traversal (CWE-22) on a Fortinet multi-product flaw added on 16 October and on a FortiMail flaw added on 1 October.

CWE IDs also group findings for compensating controls, such as web application firewall rules for injection classes, and they give developers a precise name for the mistakes behind their own CVEs. Recording the CWE on every closed ticket turns a year of patching into a picture of where flaws come from.

Where it appears on Daily CISO

Patch Tuesday carries the CWE Microsoft assigns to each tracked fix. Must-patch lists each new KEV addition, the raw material for spotting repeat weaknesses, and the security glossary contrasts CWE with CVE.

Related terms

Common Vulnerabilities and Exposures (CVE), Common Platform Enumeration (CPE), Common Vulnerability Scoring System (CVSS) and Known Exploited Vulnerabilities (KEV) catalog.

Sources

  1. MITRE (CWE Program), published October 19, 2026 · primary source
  2. MITRE (CWE Program), published January 29, 2026 · primary source
  3. MITRE (CWE Program), published December 15, 2025 · primary source
  4. NIST National Vulnerability Database, published June 27, 2024 · primary source
  5. Cybersecurity and Infrastructure Security Agency (CISA), published October 19, 2026 · primary source

Cite this definition as “Daily CISO glossary” with a link to this page. Spotted an error? Request a correction. All terms: glossary.