Common Weakness Enumeration

The Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities. It is sustained by a community project with the goals of understanding flaws in software and hardware and creating automated tools that can be used to identify, fix, and prevent those flaws. The project is sponsored by the office of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), which is operated by <a href="/facts/Mitre_Corporation/lmFLYepE">The MITRE Corporation</a>, with support from <a href="/facts/US-CERT/QPga5rmF">US-CERT</a> and the <a href="/facts/National_Cyber_Security_Division/ycjxBFj5">National Cyber Security Division</a> of the U.S. Department of Homeland Security.
The first release of the list and associated classification taxonomy was in 2006. Version 4.15 of the CWE standard was released in July 2024.
CWE has over 600 categories, including classes for buffer overflows, path/directory tree traversal errors, race conditions, <a href="/facts/Cross-site_scripting/dhtusKKm">cross-site scripting</a>, hard-coded passwords, and insecure random numbers.

Common Weakness Enumeration open-in-new

Common Weakness Enumeration