CWE
Overview
- CWE (Common Weakness Enumeration) is a community-developed, freely available taxonomy of common weakness types in software and hardware — the categories of flaw that lead to exploitable Security/Vulnerability instances.
- It provides a common language for describing and classifying weaknesses so that tools, advisories, and researchers can talk about the same defect consistently.
Normative links
Scope
- Classifies types of weaknesses (the underlying flaw class), distinct from CVE, which identifies specific instances of vulnerabilities in particular products.
Maintainer
- Maintained by MITRE and sponsored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Related