Common Weakness Enumeration
Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs.
Definition
Common Weakness Enumeration (CWE) is a category system for software and hardware weaknesses maintained by MITRE on behalf of CISA. While a CVE identifies a specific vulnerability in a specific product, a CWE identifies the underlying weakness type, for example, CWE-79 (Cross-Site Scripting), CWE-89 (SQL Injection), CWE-787 (Out-of-bounds Write), CWE-798 (Use of Hard-coded Credentials). The annual CWE Top 25 Most Dangerous Software Weaknesses ranks the most consequential weakness classes based on prevalence and severity in published CVEs.What this means in practice
Normalize applicable analysis findings to CWE where feasible and link them to secure-development controls. A Top 25 mapping alone does not demonstrate IEC 81001-5-1 conformance.Examples
- Illustrative: A developer accidentally hard-codes a default password into a device's firmware, which is an instance of CWE-798 (Use of Hard-coded Credentials).
- Illustrative: During a security audit, a static analysis tool flags several instances of uncontrolled format string vulnerabilities, identifying them as CWE-134.
- Illustrative: A team designing a new patient monitoring system reviews the CWE Top 25 to prioritize training on preventing common software weaknesses like CWE-79 (Cross-Site Scripting) in their web interface.
- •Reporting SAST findings as raw tool output without normalizing to CWE, reviewers can't compare evidence across tools without it.
- •The CWE Top 25 is not exhaustive. Pin examples to a named edition: CWE-798 is included in the 2025 Top 25, so it is not a valid example of a weakness outside that edition.
- •Conflating CWE with CVE, CWE is the class of defect, CVE is one occurrence of it in a specific product.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsCISA catalog of vulnerabilities exploited in the wild, with risk-prioritization requirements for covered federal systems.
A globally unique identifier for a publicly disclosed cybersecurity vulnerability.
An industry-standard 0–10 score that quantifies the severity of a software vulnerability.
Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device.
More in Cybersecurity
· Same categoryInternational standard defining secure-product-lifecycle activities for health software, including medical devices.
OWASP project resources for securing IoT, embedded, and connected medical devices.
Automated security testing - SAST analyzes source code at rest, DAST exercises a running application.
A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.
Where this term appears across MedTech Terms.
Sources
5 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
Official-source claim check:
CWE classifies weakness types rather than individual vulnerabilities; Top 25 is a ranked subset.
Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.
Remaining verification limits
- Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
- 1Common Weakness EnumerationTier 2 VerifiedMITREcwe.mitre.org
- 2CWE Top 25 Most Dangerous Software WeaknessesTier 2 VerifiedMITREcwe.mitre.org
- 3MDCG Cybersecurity GuidanceTier 2 VerifiedMDCGhealth.ec.europa.eu
- 4MITRE 2025 Top 25Tier 2 UncheckedMITREcwe.mitre.org
- 5FDA final guidance, February 3, 2026Tier 2 UncheckedFDAfda.gov
Inline markers like [1] jump to the matching reference above.