← Learn

Definition

What is a CWE (Common Weakness Enumeration)?

We scanned nearly 2,000 AI-built apps and 1 in 8 shipped a high-severity flaw. Want to check yours?Scan free →

A CWE, or Common Weakness Enumeration, is a numbered category in a community-maintained catalog of software weakness types. For example, CWE-89 is SQL injection and CWE-79 is cross-site scripting. Security tools cite CWE numbers so that a finding refers to a precise, shared definition of the weakness rather than an ambiguous label.

CWE vs CVE

A CWE is a type of weakness, a class like improper input validation. A CVE is a specific vulnerability in a specific product. Many CVEs are instances of the same CWE. When a scanner reports a finding, it usually gives a CWE because it is describing the kind of flaw, not a catalogued product bug.

Why it is useful

A CWE number turns a vague description into something you can look up, compare, and prioritize. It also connects a finding to guidance and to related weaknesses, which is why every Prbl fix page lists the CWE for the issue it covers.

What this means for AI-generated code

Because AI tools introduce a fairly small set of recurring weakness types, the same handful of CWEs show up again and again in AI-generated code: 798 for hardcoded credentials, 89 for SQL injection, 862 for missing authorization, and a few more.

Want to know if your app has this issue? Scan a public repo free, no account needed.

Scan a repo →

Related: browse fixes by weakness

What Is a CWE? Common Weakness Enumeration, Explained: Prbl