CWE
Common Weakness Enumeration
Klassifikations-Schema für Software-Schwachstellen
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. This makes it possible to move from the individual flaw to the actual root cause and thus to prevention.
History & facts. Like CVE, CWE is maintained by MITRE and falls under the same federal funding framework. The catalogue arranges weaknesses hierarchically and groups them into views — best known is the annually updated „CWE Top 25 Most Dangerous Software Weaknesses“, which prioritises the most consequential defect classes in practice. Each CVE can be mapped to one or more CWEs, enabling pattern recognition across many individual cases.
Outlook & recommendation. For development and procurement, CWE is more valuable than any single CVE list because it targets the cause rather than the symptom: systematically eliminating a particular CWE class also eliminates future, still-undiscovered CVEs of the same kind. In secure-coding guidelines and conformity assessment under the CRA, aligning with the CWE top classes is a pragmatic starting point.