All articles
- CWE
- Security
- Basics
What a CWE ID Tells You About a Bug
CWE identifiers turn a vague security finding into a precise, trackable class of weakness. A short guide to reading them and using them to prioritize fixes.
· 5 min read · Lina Source LLC
The Common Weakness Enumeration (CWE) is a public catalog of software weakness types maintained by MITRE. When a report labels a finding CWE-89, everyone on the team knows exactly what kind of bug it is: SQL injection.
Why the ID matters
- It is precise: CWE-79 (cross-site scripting) and CWE-601 (open redirect) are both web bugs, but they have different fixes.
- It is trackable: counting findings by CWE over time shows whether a class of bug is actually going away.
- It connects to guidance: each CWE entry links to examples, detection methods and mitigations.
CWE is not severity
A CWE describes the kind of weakness, not how bad this instance is. A SQL injection in an admin-only script and one in a public search endpoint share CWE-89 but carry very different risk. That is why every CodeAuditAgent finding carries both a CWE and a severity based on real exploitability.
IDs you will see most often
- CWE-89: SQL injection
- CWE-79: cross-site scripting
- CWE-639: authorization bypass through user-controlled key
- CWE-798: use of hardcoded credentials
- CWE-918: server-side request forgery