A CWE, or Common Weakness Enumeration, is a numbered category in a community-maintained catalog of software weakness types. For example, CWE-89 is SQL injection and CWE-79 is cross-site scripting. Security tools cite CWE numbers so that a finding refers to a precise, shared definition of the weakness rather than an ambiguous label.
CWE vs CVE
A CWE is a type of weakness, a class like improper input validation. A CVE is a specific vulnerability in a specific product. Many CVEs are instances of the same CWE. When a scanner reports a finding, it usually gives a CWE because it is describing the kind of flaw, not a catalogued product bug.
Why it is useful
A CWE number turns a vague description into something you can look up, compare, and prioritize. It also connects a finding to guidance and to related weaknesses, which is why every Prbl fix page lists the CWE for the issue it covers.
What this means for AI-generated code
Because AI tools introduce a fairly small set of recurring weakness types, the same handful of CWEs show up again and again in AI-generated code: 798 for hardcoded credentials, 89 for SQL injection, 862 for missing authorization, and a few more.