Common Weakness Enumeration (CWE) is a standardized taxonomy for software weakness root causes. Instead of labeling a flaw only as a specific vulnerability, CWE groups it by the underlying coding or design problem, such as improper input validation, weak authentication, or unsafe memory handling. This helps security teams speak the same language when reviewing findings across scanners, code audits, and penetration tests.
CWE matters because recurring weakness classes are often what attackers exploit at scale. A single bug may be patched, but if the root cause remains, the same pattern can reappear in later releases or in other products. Defenders use CWE to prioritize fixes, track trends, improve secure coding guidance, and measure whether a development process is reducing entire categories of risk rather than just closing individual tickets.