CWE Explorer¶

See where a weakness or a vulnerability sits in MITRE's CWE hierarchy, in the terminal or in the browser.

Give cwex a CWE (79, CWE-79) or a CVE (CVE-2021-44228):

For a CWE: its type, status, publication date and description, its lineage up to the top of MITRE's View 1000 (Complete Weakness Hierarchy), and whether MITRE recommends using it to map vulnerabilities.
For a CVE: the CWEs linked to the vulnerability, who links each one (the organization that published it, CISA, the NVD or the CWE catalog), all of them placed in the same hierarchy, and a warning when the sources disagree.

CVE-2021-44228 (Log4Shell) in the browser, linked to its five CWEs — `cwex CVE-2021-44228 --web`. Log4Shell in the browser: the CVE (the dark node on the right, tagged KEV because it is known to be exploited) is linked to its five CWEs, each in its place in View 1000. Its panel shows the CVSS scores and the exploitation signals.

Install¶

pipx install cwe-explorer     # or: pip install cwe-explorer · uv tool install cwe-explorer

Requires Python 3.9 or later and has no dependencies. It installs the command cwex (also available as cwe-explorer).

Quick start¶

cwex 79                       # a CWE: its details and its place in the hierarchy
cwex CVE-2021-44228           # a CVE: its CWEs and the hierarchy that joins them
cwex CVE-2021-44228 --web     # the same, as an interactive graph in the browser
cwex 79 --tui                 # an interactive explorer in the terminal
cwex --check CVE-2021-44228   # should the CVE's CWEs be used to map it?
cwex 79 --json                # everything about CWE-79 as JSON
cwex --docs                   # this documentation, served by cwex itself

The interactive explorer on CWE-693 Protection Mechanism Failure, with CWE-347 selected — `cwex 693 --tui`. The interactive explorer on CWE-693 *Protection Mechanism Failure*, with CWE-347 selected.

Where to go next¶

Page	What it covers
Features	Everything CWE Explorer can do, with an example and a figure for each
User guide	Every mode: the tree, the interactive explorer, the browser and its filters, `--detailed`, CVEs and their exploitation signals (KEV, SSVC, EPSS), the CVEs of a CWE, mapping guidance and `--check`, ancestors and descendants, other views (`--view`), JSON output, data and cache
Views	How to list the views of the catalog (CWE Top 25, OWASP Top Ten, the NVD's…) and open them in the terminal and in the browser
JSON reference	The structure of every JSON output, field by field, with examples
Limitations	What the hierarchy and the CVE links can and cannot tell you, with figures from the catalog
How CWE Explorer links CVEs to CWEs	Data sources, merge rules and how links are placed in the hierarchy, with diagrams
The CVE ecosystem	Who the CNAs, the ADPs, the NVD and the CWE catalog are, and how they relate

CWE Explorer is released under the MIT license. The CWE catalog is published by MITRE; CVE records come from CVE.org and the NVD.