When you read security reports, you often come across references such as CWE-79 or CWE-89 alongside CVE numbers. These stand for types of weaknesses: CWE-79 is cross-site scripting, CWE-89 is SQL injection. The list is developed further by the expert community, sponsored by the US agency CISA, and operated by the MITRE Corporation.
CWE and CVE: the difference
MITRE draws a clear distinction: a weakness is an underlying condition that can lead to vulnerabilities in many products. A vulnerability is a specific instance of one or more such weaknesses in a particular product. The CVE ID therefore names the individual case, for example a flaw in version 2.4 of a web portal. The CWE ID states which programming error lies behind it. In addition, the CAPEC catalog describes the typical attack patterns used to exploit such weaknesses.
The CWE Top 25
Every year, the CWE program publishes the 25 most dangerous software weaknesses, derived from published CVE records. The 2025 list from December 2025 is based on 39,080 CVE records from the period June 2024 to June 2025. The top five:
- CWE-79: Cross-site scripting
- CWE-89: SQL injection
- CWE-352: Cross-site request forgery
- CWE-862: Missing authorization
- CWE-787: Out-of-bounds write
It is striking that many of these types of weaknesses have been known for years and can be avoided with proven techniques.
In practice for SMEs and municipalities
- For in-house development: Use the Top 25 as a checklist for code reviews and tests. Automated analysis tools usually map their findings to a CWE.
- When purchasing: Ask vendors of web portals, line-of-business applications, or apps how they prevent common types of weaknesses and whether regular penetration tests take place. A bill of materials for the components, the SBOM, completes the picture.
- For findings: A vulnerability scan or pentest names the CWE. This lets you check whether the same error is also present elsewhere in the application.
Risks and limitations
CWE describes types of weaknesses, not the threat situation. A weakness from the Top 25 is not automatically more urgent than a rarer one. New types of weaknesses, for example in AI applications such as prompt injection, are also still being developed in the catalog. The CWE program has announced version 5.0 for October 28, 2026, with fundamental changes to the data schema; tools that ingest CWE data automatically should be prepared for this.
How TOMORIS relates
TOMORIS NEXT Development plans authorization and security concepts from the start and tests applications before rollout. For existing systems, EXPERTS Cyber Security helps you address vulnerabilities by impact and urgency.