flawopen.com/CWE vs CVE

CWE vs. CVE: what's the difference?

Reference page — draft, pending review
Short answer

CWE is the category — a type of bug, like "SQL Injection" (CWE-89). CVE is the instance — one specific, documented occurrence of a vulnerability in a specific product and version, like "SQL injection found in Product X version 2.3."

A concrete way to think about it

CWE is to CVE roughly what a species is to an individual animal. "SQL Injection" (CWE-89) describes a whole class of bug pattern; a specific CVE (e.g. one with an ID like CVE-2024-XXXXX) describes one confirmed instance of that pattern found in one real piece of software, with a specific affected version range and a specific fix.

How they relate on this site

Every ExplainerPage on flawopen.com is organized by CWE

The vulnerability class × language matrix (SQL Injection in Python, XSS in Java, etc.) is built around CWE categories — the general pattern and how to avoid it, not any one specific product's history.

CVE writeups are a separate, selective layer

When a specific CVE is significant and broadly relevant enough to warrant coverage, it gets its own writeup that links back to its CWE class — but not every CVE gets one, since most are narrow to a single product/version.

FAQ

Who maintains CWE and CVE?

Both are maintained by MITRE, with CVE also being coordinated with NVD (the U.S. National Vulnerability Database) for enrichment like CVSS scoring.

Does every CVE have a CWE?

Most do — CVE records are typically tagged with one or more CWE classifications describing the underlying bug pattern.

References