What does CWE stand for?
CWE stands for Common Weakness Enumeration. A catalogue of software weakness types, such as SQL injection (CWE-89). A CVE is one specific flaw; a CWE is the category of mistake behind it.
CWE is a community-developed catalogue, maintained by MITRE, of the types of mistakes that lead to vulnerabilities in software and hardware. Each type has an identifier: CWE-79 is cross-site scripting, CWE-89 is SQL injection. Tools and advisories use these identifiers so that everyone names a class of flaw the same way. A weakness is the kind of error; a vulnerability is one concrete occurrence of it in a product.
CWE in practice: an example
A code scanner reports CWE-798, use of hard-coded credentials, in a configuration module. The developer looks up the entry, reads the description and the suggested mitigations, and moves the secret to a vault. No CVE exists, because the flaw was fixed before release.
What CWE is confused with
CWE vs CVE: what is the difference?
A CVE identifies one specific vulnerability in one product, such as CVE-2021-44228. A CWE identifies the category of mistake behind it. Many CVEs map to the same CWE. What CVE stands for
CWE vs CVSS: what is the difference?
CVSS scores how severe a vulnerability is, from 0 to 10. CWE says what kind of flaw it is and carries no score. What CVSS stands for
Which exams cover CWE?
CWE is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: on the acronym list, not tied to one objective.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A report says a product flaw “is an instance of CWE-89”. What does that tell you?
- Its severity score is 8.9
- It is an SQL injection weakness
- It was the 89th vulnerability found this year
- It affects 89 products
Show the answer
B. It is an SQL injection weakness. CWE identifiers name weakness types, and CWE-89 is SQL injection. Severity comes from CVSS, and specific flaws are numbered by CVE.
2. Which catalogue would a development team use to train programmers on the kinds of coding errors to avoid?
- CWE
- CVE
- CVSS
- EPSS
Show the answer
A. CWE. CWE describes classes of mistakes with examples and mitigations, which is what training needs. CVE lists individual flaws in shipped products.
Sources: MITRE: About CWE; NIST glossary: Common Weakness Enumeration. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.