flawopen.com/CWE vs CVE
CWE is the category — a type of bug, like "SQL Injection" (CWE-89). CVE is the instance — one specific, documented occurrence of a vulnerability in a specific product and version, like "SQL injection found in Product X version 2.3."
CWE is to CVE roughly what a species is to an individual animal. "SQL Injection" (CWE-89) describes a whole class of bug pattern; a specific CVE (e.g. one with an ID like CVE-2024-XXXXX) describes one confirmed instance of that pattern found in one real piece of software, with a specific affected version range and a specific fix.
The vulnerability class × language matrix (SQL Injection in Python, XSS in Java, etc.) is built around CWE categories — the general pattern and how to avoid it, not any one specific product's history.
When a specific CVE is significant and broadly relevant enough to warrant coverage, it gets its own writeup that links back to its CWE class — but not every CVE gets one, since most are narrow to a single product/version.
Both are maintained by MITRE, with CVE also being coordinated with NVD (the U.S. National Vulnerability Database) for enrichment like CVSS scoring.
Most do — CVE records are typically tagged with one or more CWE classifications describing the underlying bug pattern.