CWE
Also known as Common Weakness Enumeration
A classification of the underlying types of software weakness, describing categories rather than specific instances.
Where a CVE names one vulnerability in one product, a CWE names the class of mistake behind it, such as improper input validation or use of hard-coded credentials.
It is useful for development teams because fixing a class of weakness prevents future instances, rather than patching each one as it is discovered.
Where this comes up
CWE sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
CVE A unique public identifier assigned to a specific known vulnerability. OWASP Top 10 A widely referenced list of the most critical web application security risks, updated periodically. Vulnerability A weakness in software, configuration, or process that an attacker could use to do something they should not be able to do.