About CWEs¶

The CWE categorization contains several types of entity, collectively known as CWEs. The CWEs that we consider in this report are only those of the types:

• Weakness Class

• Weakness Base

• Weakness Variant

• Compound Element

Other types of CWE that do not correspond directly to weaknesses are omitted.

The CWE categorization includes relationships between entities, in particular a parent-child relationship. These relationships are associated with Views (another kind of CWE entity). For the purposes of coverage claims, we use the “Research View.”

Every security query is associated with one or more CWEs, which are the most precise CWEs that are covered by that query. Overall coverage is claimed for the most-precise CWEs, as well as for any of their ancestors in the View.

Note that the CWE coverage includes both “supported queries” and “experimental queries.”