A CWE, or Common Weakness Enumeration, is a numbered category in a community-maintained catalog of software weakness types. For example, CWE-89 is SQL injection and CWE-79 is cross-site scripting. Security tools cite CWE numbers so that a finding refers to a precise, shared definition of the weakness rather than an ambiguous label.
CWE vs CVE
A CWE is a type of weakness, a class like improper input validation. A CVE is a specific vulnerability in a specific product. Many CVEs are instances of the same CWE. When a scanner reports a finding, it usually gives a CWE because it is describing the kind of flaw, not a catalogued product bug.
Why it is useful
A CWE number turns a vague description into something you can look up, compare, and prioritize. It also connects a finding to guidance and to related weaknesses, which is why every Prbl fix page lists the CWE for the issue it covers.
What this means for AI-generated code
Because AI tools introduce a fairly small set of recurring weakness types, the same handful of CWEs show up again and again in AI-generated code: 798 for hardcoded credentials, 89 for SQL injection, 862 for missing authorization, and a few more.
Common questions
What CWE numbers appear most often in AI-generated code?
The most common in our scans: CWE-798 (Use of Hardcoded Credentials), CWE-862 (Missing Authorization), CWE-326 (Inadequate Encryption Strength), CWE-338 (Use of Cryptographically Weak PRNG), CWE-295 (Improper Certificate Validation), CWE-89 (SQL Injection), and CWE-78 (Command Injection). These match OWASP A01-A03 and are predictable across every tool we have measured.
What is the difference between a CWE and a CVE?
A CWE is a weakness type — a class like improper input validation. A CVE is a specific vulnerability in a specific product, with a severity score and a patch. A scanner that finds a SQL injection in your code reports a CWE (the type of problem). A dependency scanner that finds a vulnerable version of a library reports a CVE (the specific known bug).
Where can I look up what a CWE means?
The authoritative source is cwe.mitre.org — search by CWE number or name to see the full definition, examples, and mitigations. OWASP also maps its Top 10 categories to relevant CWE numbers, so you can navigate between the two frameworks.