SECAI Core · phase 14 of 15 · noun

Common Weakness Enumeration

A community-developed list and classification system for common software and hardware security flaws (weaknesses) that can lead to vulnerabilities.

The Explain card

Plain English
CWE is a community-maintained catalogue that classifies the underlying types of software and hardware flaws, the root causes, rather than individual vulnerabilities.
Example
Several AI frameworks have had code execution bugs when loading serialised models. Each has its own CVE, but they share one CWE: deserialisation of untrusted data. Fixing the weakness class prevents the next instance.
Why it matters
Patching CVEs is whack-a-mole. Understanding CWEs lets defenders design AI pipelines that avoid whole categories of mistakes, and train developers to spot them.
Hook
CVE is the symptom, CWE is the diagnosis.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

During a model-serving API review, the scanner maps an unchecked buffer copy to Common Weakness Enumeration entry CWE-120 for remediation.

Why these words
  • common Latin communis, shared, through Old French comun modifies weakness to indicate a type recognized across many systems or sources
  • weakness Old English wāc, weak, plus the noun-forming suffix -ness identifies what is being enumerated
  • enumeration Latin enumeratio, a counting or listing serves as the head noun and presents the material as an ordered set of named entries
Where it came from
Origin
an English technical name coined by MITRE from common, weakness, and enumeration
Entered the language
2006
What changed
Enumeration broadened from numerical counting to systematic listing, and the three ordinary words became a formal cybersecurity title abbreviated CWE.
How it is spelled
Pattern
Each main word is capitalized in the official title.
Pattern
The initial letters form the initialism CWE.
Pattern
Weak remains unchanged when the suffix -ness is added.

Spelled like

  • darkness
  • meekness
  • classification
  • configuration
Broken into chunks
  • common
    • communal
    • community
  • weak + ness
    • weakly
    • weakening
  • numer
    • numeral
    • innumerable
  • -ation
    • classification
    • configuration
What it sits beside

Same subject

Same shape

security identifier systems

  • CWE identifiers
  • CVE identifiers
  • CAPEC identifiers

capitalized technical initialisms

  • CWE
  • CVE
  • CVSS

Where it sits in the deck

Phase 14: Incident Response, Evaluation, and Knowledge Bases

When detection fires, teams need structured response plans, scoring frameworks, and curated knowledge bases to triage, measure, and learn from AI security events.

Neighbours in this phase