CWEs

The Common Weakness Enumeration is MITRE’s catalog of software and hardware weakness classes — buffer overflows, missing authentication, improper input validation, hard-coded credentials. Where a security advisory is “this specific flaw in this specific product”, a CWE is “this kind of flaw”. Tagging your exposures with CWEs is what turns a list of individual findings into an answer to “what keeps going wrong here”.

Where to find it

Catalog → CWEs in the sidebar.

Key concepts

It is a loaded catalog

CWEs ship as their own library. Loading it publishes the entries so they are available across the platform; until you load it, the CWE pickers on vulnerabilities and advisories are empty. The list is deliberately spare — Reference ID (the familiar CWE-79 form), Name, Description, the Library that supplied it, its Domain, and any Labels you add.

Like other catalog content, CWEs are read-only reference material. You classify with them; you do not edit them.

Weakness versus vulnerability versus advisory

Three layers that people routinely conflate:

Layer	Example	Scope
CWE	Improper neutralisation of input during web page generation	A class of flaw, product-independent
Security advisory	A specific published CVE in a specific product version	One flaw, one product
Vulnerability	Your record of being exposed to it, with an owner and an SLA	Your organization

A vulnerability can link to several advisories and several CWEs. That is what makes categorical analysis possible: the advisories say what you are exposed to, the CWEs say what kind of mistake it is.

What the classification buys you

The individual view — “we have 47 open vulnerabilities” — tells you how busy you are. The categorical view tells you what to fix upstream:

• Recurring classes point at process, not at patches. Ten findings across four systems that all tag CWE-798 means credentials are being hard-coded as a matter of habit, and no amount of remediation tickets will stop the eleventh.
• Class coverage exposes blind spots. If nothing in your catalog is ever tagged with an access-control weakness, either you are unusually good at access control or nobody is testing for it.
• Class is stable when products are not. Systems get replaced; the ways people get them wrong do not. Trending by CWE gives you a line that means something over several years.

Tip

Make the CWE field a required part of triage rather than an optional nicety. A vulnerability logged without a weakness class still gets fixed, but it contributes nothing to the pattern — and the pattern is the only part of this data that changes behaviour.

Working with CWEs

Search by reference ID or name, and filter by domain and labels. Labels are useful for marking the subset your own technology stack can actually exhibit, so triage does not require scrolling a catalog of many hundreds of entries.

Enrichment feeds can attach CWE mappings to advisories automatically when they are enabled in settings, which means an advisory often arrives already classified and the vulnerability you raise from it inherits that context.

Related

• Security advisories — the specific flaws these classes categorise.
• Risk assessments — where exposure is evaluated and treated.
• Libraries — where the CWE catalog is loaded from.