Features¶
Everything CWE Explorer can do, with an example of each. The User guide explains every option in detail.
Look up a CWE in the terminal¶
cwex 79 prints the weakness's card: its type, structure, status, publication date,
whether MITRE recommends using it to map vulnerabilities, its description and its
relationships. Below the card, a tree shows where it sits in View 1000: its lineage
up to the top of the hierarchy and, by default, two levels of descendants.
cwex 79. The card of CWE-79 and its place in View 1000:
lineage up to the pillar CWE-707 and two levels of descendants. The columns on the
right show each entry's mapping mark (! discouraged), its status and the
year it was published.A CWE can be written as 79, CWE-79 or cwe79. If the ID belongs to a grouping,
a view or a deprecated entry, cwex explains why it is not part of View 1000.
--depth changes how many levels of descendants are shown (--depth all for every
one), and --search "race" finds weaknesses by name.
Explore in the terminal¶
cwex 79 --tui opens an interactive explorer: the hierarchy on the left and the card
of the selected entry on the right. Move with the arrow keys or the mouse, press
Enter to re-center the hierarchy on an entry, b to go back, + and - to show
more or fewer levels, and / to jump to another CWE or to a CVE.
cwex 693 --tui. The interactive explorer on CWE-693
Protection Mechanism Failure, with CWE-347 selected. The header explains the
type badges and the right-hand columns.More: The interactive explorer.
Explore in the browser¶
cwex 79 --web draws the hierarchy as an interactive graph and opens it in the
browser. Click a node to see its details and highlight its lineage, double-click it
to rebuild the graph around it, and use +N on a node to expand its children.
cwex 79 --web. The graph of CWE-79 with CWE-83 selected:
the side panel shows its details and the thick line marks its lineage. Every node
shows its status and the year it was published.The page is a single HTML file that embeds all of View 1000, so it works without a connection and can be shared. More: The browser.
Search¶
The search box jumps to any CWE by ID or name. Typing a CVE ID looks it up online from the page itself and links it to its CWEs, without going back to the terminal.
sql lists the weaknesses whose name
mentions it, with their type.
Filters¶
The Filter button keeps the graph to the weaknesses that matter: by type, status, mapping usage or year of publication. The rest are dimmed, so the hierarchy keeps its shape, or hidden, so only the matching weaknesses remain. The filters travel in the address, so a filtered view can be shared.
More: Filters.
Full screen¶
The full-screen button (or the F key) gives the whole window to the graph. The
details of a node then open in a floating panel, closed with × or Esc.
Dark mode and phones¶
The page follows the system's dark mode and adapts to small screens, where the details move below the graph.
Look up a CVE¶
Every mode also accepts a CVE: cwex CVE-2021-44228. CWE Explorer downloads the
record from CVE.org and the NVD, collects the CWEs that each source links to the
vulnerability, and places all of them in the same hierarchy. Each link says who
made it: the organization that published the CVE (its CNA), CISA, the NVD, or the
CWE catalog, which lists the CVE as an observed example.
cwex CVE-2021-44228 (Log4Shell). The card of the CVE, with
its CVSS scores and the five CWEs linked to it and who links each one, followed by
the hierarchy that joins them (◀ marks the linked CWEs). The card of each
CWE, printed in between, is left out here.
cwex CVE-2021-44228 --tui. The CVE is the first row of the
explorer, above the CWEs linked to it. Pressing / looks up another
CVE without leaving the explorer.
cwex CVE-2021-44228 --web. The CVE is one more node (the
dark one on the right), linked to its five CWEs; the KEV tag says it is known to be
exploited. Its panel shows the CVSS scores and the exploitation signals.Is it being exploited?¶
CVSS says how severe a vulnerability is, not how likely it is to be attacked. The CVE card adds three signals: whether the CVE is in CISA's Known Exploited Vulnerabilities catalog (KEV), CISA's SSVC assessment, and FIRST's EPSS probability of exploitation in the next 30 days.
More: Exploitation signals.
When the sources disagree¶
The organization that published the CVE and the NVD often choose different CWEs. When their choices fall in different branches of the hierarchy (none is an ancestor or descendant of another), CWE Explorer warns about it. Each linked CWE also carries MITRE's mapping advice, so a CWE that should not be used to classify vulnerabilities is easy to spot.
More: CVEs and How CVEs are linked to CWEs.
Find the CVEs of a CWE¶
cwex 79 --cves goes the other way: it asks the NVD how many CVEs have the weakness
and lists the most recent ones. --since limits it to a period, and
--include-descendants adds the count of every weakness below it.
cwex 79 --cves --limit 8. 25,193 CVEs in the NVD list
CWE-79, and the eight most recent, all published that day, with their CVSS score and
the start of their description.
More: CVEs of a CWE.
Check whether a CWE should be used for mapping¶
MITRE marks each CWE as Allowed, Allowed-with-Review, Discouraged or Prohibited for mapping real-world vulnerabilities, and often explains why and suggests better entries. CWE Explorer shows this advice everywhere: as a mark in the trees, in every card and in the side panel of the browser.
cwex --check reviews a list of CWEs and CVEs at once. It exits with an error when
one of them is prohibited (or also discouraged, with --strict), so it can stop a
pipeline that classifies vulnerabilities with the wrong CWE.
cwex --check 20 79. CWE-20 is discouraged, with MITRE's
reasons and suggestions; CWE-79 is allowed. The check passes because nothing is
prohibited.More: Mapping guidance.
Read the full catalog entry¶
--detailed adds every section of the CWE catalog entry, in the same order as
cwe.mitre.org: alternate terms, consequences, mitigations, demonstrative examples
with their code, observed examples, detection methods, related attack patterns,
references and more. It works with the tree, the interactive explorer and the
browser.
cwex 79 --web --detailed. The catalog sections of CWE-79 as
collapsible blocks in the side panel, with Demonstrative Examples open: bad
code is marked in red and attacks in amber.More: Full details.
List ancestors or descendants¶
--ancestors lists the weaknesses above a CWE and --descendants the ones below it,
level by level. Each entry says through which CWE it is reached and whether it is on
the primary lineage. A weakness can have several parents, so it can have more
ancestors than its single lineage suggests.
cwex 425 --ancestors --depth all. CWE-425 Direct
Request has three parents and eleven ancestors in total, from three different
pillars. The primary lineage is shown in bold.More: Ancestors and descendants.
Explore other views¶
View 1000 holds every weakness. MITRE also publishes views for a purpose: the CWE Top 25 of each year, the OWASP Top Ten, the reduced set the NVD maps vulnerabilities to (View 1003), weaknesses by topic (699, 1194)…
Top 25, OWASP Top Ten and the NVD's view¶
The card of every weakness says whether it is in the latest CWE Top 25 and at what
rank, in which category of the latest OWASP Top Ten, and whether it is in the NVD's
View 1003. --check also notes the weaknesses outside View 1003.
cwex 79. CWE-79 is number 1 in the 2025 CWE Top 25, belongs
to category A05 (Injection) of the OWASP Top Ten 2025, and is in View 1003, which the
NVD uses.In the browser, the Top 25 rank is a tag on each node, and the Member of filter keeps only the weaknesses of those lists.
#5, #6…).Browse another view¶
--view ID replaces View 1000 in every mode, and cwex --views lists the views that
can be browsed. In views organized by topic, the groupings (formerly categories,
Gr) become nodes, and the view itself is the root (Vw).
cwex --view 699. The Software Development view and its
first level: 40 groupings, each with the number of weaknesses it holds (13 of them
shown here).
cwex --view 1450 --web, centered on CWE-79: in the OWASP Top
Ten 2025 it hangs from category A05:2025 - Injection. The headline says which view is
shown, and the panel lists the featured views that contain the weakness.More: Views, which explains how to open any view in the terminal and in the browser.
Export everything as JSON¶
--json prints everything CWE Explorer knows about a CWE or a CVE, for scripts and
other tools: for a CVE, also its exploitation signals (KEV, SSVC and EPSS). Every
other mode has its own JSON output, and all of them are described field by field in
the JSON reference.
$ cwex 79 --json
{
"schema": 1,
"type": "cwe",
"id": 79,
"cwe": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation",
"status": "Stable",
"published": "2006-07-19",
"mapping": { "usage": "Allowed", "level": "ok", ... },
"lineages": [[707, 74, 79]],
"ancestors": [{ "id": 74, "distance": 1, "primary_parent": true, ... }],
"descendants": [ ... 8 weaknesses ... ],
"observed_cves": ["CVE-2006-3211", "CVE-2006-3295", ... 20 CVEs ...],
"details": [ ... every section of the catalog entry ... ],
...
}
cwex 79 --json. For a CVE, the
output holds the merged record with the exploitation signals, the mapping check and
the full record of each linked CWE.More: JSON reference.
Use it from an AI agent¶
cwex --install-skill teaches an AI agent such as Claude Code to use CWE Explorer:
when a question is about a CWE or a CVE, the agent runs cwex … --json and answers
from the official data, with the right numbers, names, parents and mapping guidance.
More: AI agents.
Work offline¶
The CWE catalog is downloaded once and kept in a cache, so CWEs work without a
connection afterwards; cwex --update downloads it again. CVE records are cached for
seven days, EPSS scores and the CVEs of a CWE for one day, and an older copy is used
when there is no connection. With an NVD API key, the NVD
allows ten times as many lookups.
Read this documentation offline¶
cwex --docs serves this documentation from your computer and opens it in the
browser. It is installed with the package, so it matches your version of cwex.