flawopen.com/CWE vs CVE
CWE vs. CVE: what's the difference?
CWE names a kind of weakness; CVE identifies a vulnerability record. One weakness can appear in many CVEs, one CVE can involve linked weaknesses, and some CVE records have no CWE mapping.
A concrete way to think about it
CWE classifies a weakness; a CVE ID identifies a particular vulnerability record. Their relationship is not one-to-one: one weakness can underlie many CVEs, and one CVE can involve a chain of weaknesses. MITRE’s CWE-126 entry uses Heartbleed (CVE-2014-0160) as an example: inconsistent length handling (CWE-130) enabled a buffer over-read (CWE-126). The CVE remains one vulnerability record; the two CWEs describe different links in its failure chain.
How they relate on this site
The vulnerability class × language matrix (SQL Injection in Python, XSS in Java, etc.) is built around CWE categories — the general pattern and how to avoid it, not any one specific product's history.
When a specific CVE is significant and broadly relevant enough to warrant coverage, it gets its own writeup that links back to its CWE class — but not every CVE gets one, since most are narrow to a single product/version.
FAQ
MITRE maintains the CWE List. CWE and CVE are separate programs with complementary roles; CVE records are authored by CVE Numbering Authorities (CNAs). NVD is a separate NIST program that consumes CVE data and may add its own CWE mappings and other enrichment. An NVD mapping is not automatically the original CNA’s classification.
No. A CVE record can lack a specific CWE mapping. For example, NVD shows NVD-CWE-noinfo (“Insufficient Information”) for CVE-2021-27823. NVD may display CWE information supplied by the CNA alongside its own enrichment. Treat a CWE label as classification metadata, not proof that the record captures the full root cause or chain.