JSON reference¶

Every mode of cwex prints JSON with --json, for scripts and other tools. This page describes every output: its fields, their types and what they mean. For what each mode does, see the User guide.

Outputs¶

Command	`type`	Content
`cwex 79 --json`	`cwe`	Everything about a CWE: see A CWE
`cwex CVE-2021-44228 --json`	`cve`	Everything about a CVE: see A CVE
`cwex 79 --ancestors --json` (or `--descendants`)	`relatives`	See Ancestors and descendants
`cwex CVE-2021-44228 --ancestors --json` (or `--descendants`)	`cve-relatives`	See Ancestors and descendants of a CVE
`cwex --check 20 CVE-2021-44228 --json`	`check`	See Mapping check
`cwex 79 --cves --json`	`cwe-cves`	See CVEs of a CWE
`cwex --search sql --json`	`search`	See Search
`cwex --views --json`	`views`	See Views

--json cannot be combined with --tui or --web. With --view ID, the cwe, cve, relatives, cve-relatives and search outputs describe that view instead of View 1000 (catalog.view says which one), and groupings and the view itself can appear as entries.

Exploitation signals (KEV, SSVC and EPSS) are part of the CVE record, as cve.kev, cve.ssvc and cve.epss, so they come with the cve and cve-relatives outputs. In cwe-cves, each recent CVE carries the date it was added to the KEV catalog (kev). The check output does not include them, because the check only looks at the CWEs; use cwex CVE-… --json for them.

Conventions¶

One object per run, printed to standard output as indented UTF-8. Progress messages and errors go to standard error, so cwex … --json | jq always receives valid JSON or nothing.
schema and type. Every output starts with schema, the version of the format (currently 1), and type, which says which of the structures below it is. Later versions may add fields without changing schema; it changes only when a field is removed or changes meaning.
Identifiers. id is always a CWE number, as an integer (79). CWE labels are strings ("CWE-79"), and so are CVE IDs ("CVE-2021-44228"). The field cwe holds the number in links, verdicts and the relatives output, but the label in the record of a CWE (type cwe) and in cwe-cves.
Dates are strings in the form YYYY-MM-DD. The only exception is counted in cwe-cves, which adds the time ("2026-11-04 12:41 UTC").
Missing values. Text that the catalog or a source does not give is an empty string "". An object that does not apply is null: kev for a CVE that is not in the KEV catalog, note when there is nothing to explain. Lists are empty ([]), never null.
CVSS scores are strings with one decimal ("10.0"), as the sources publish them.
Depths are integers, or the string "all" when every level was requested.
Exit status. 0 on success. 1 when the identifier cannot be used (it does not exist, or it is a grouping, a view or a deprecated entry), when a lookup fails, when --check fails or when --search finds nothing. 2 for wrong options. With 1 or 2 nothing is printed to standard output, except for --check and --search, which print their result first.

Shared objects¶

These objects appear in several outputs.

Catalog¶

catalog, in every output: the CWE catalog the answer comes from.

Field	Type	Content
`name`	string	Always `"CWE"`
`version`	string	Version of the catalog, for example `"5.0"`
`date`	string	Release date of that version
`view`	string	The view used: `"1000"`, MITRE's Complete Weakness Hierarchy, unless `--view` chose another
`view_name`	string	Its name, such as `"Complete Weakness Hierarchy"`

Weakness summary¶

A weakness in a list: parents and children of a CWE, results of search and by_cwe of cwe-cves.

Field	Type	Content
`id`	integer	CWE number
`name`	string	Name of the weakness
`abstraction`	string	`Pillar`, `Class`, `Base`, `Variant` or `Compound`. In views other than 1000 also `Grouping` (formerly a Category) and `View` (the view itself, the root)
`status`	string	How mature MITRE considers it: `Stable`, `Usable`, `Draft`, `Incomplete`, `Deprecated` or `Obsolete`
`published`	string	Release date of the catalog version in which it first appeared
`mapping_usage`	string	MITRE's guidance for mapping vulnerabilities to it: `Allowed`, `Allowed-with-Review`, `Discouraged`, `Prohibited`, or `""` when the entry gives none
`url`	string	Its page on cwe.mitre.org

Relative¶

A weakness summary plus where it sits relative to the queried CWE: ancestors and descendants of a CWE, and results of relatives. Ordered by distance.

Field	Type	Content
(weakness summary)		`id`, `name`, `abstraction`, `status`, `published`, `mapping_usage` and `url`, as above
`distance`	integer	1 for a parent or child, 2 for a grandparent or grandchild, and so on. With several paths, the shortest
`via`	array of integers	The weaknesses of the previous level through which it is reached. At distance 1, the queried CWE
`primary_parent`	boolean or null	At distance 1, whether the link between both is the primary `ChildOf`; `null` at other distances
`primary_lineage`	boolean	For an ancestor, whether it is on the queried CWE's primary lineage. For a descendant, whether the queried CWE is on the descendant's primary lineage

Verdict¶

Whether a CWE should be used to map vulnerabilities, following MITRE's Vulnerability Mapping Notes. It is the mapping of a CWE record (with two more fields), and each item of mapping_check.verdicts and checks[].verdicts.

Field	Type	Content
`ref`	string	What was checked: `"CWE-20"`, or an NVD value such as `"NVD-CWE-noinfo"`
`cwe`	integer or null	Its number; `null` for NVD values and text that is not a CWE
`name`	string	Name of the weakness; `""` if it is not a weakness of View 1000
`level`	string	`ok` (Allowed), `review` (Allowed-with-Review, and NVD values), `discouraged`, `prohibited`, `error` (not a usable weakness: it does not exist, or it is a grouping, a view or a deprecated entry) or `unknown` (the entry gives no guidance)
`usage`	string	MITRE's usage value, as in `mapping_usage`, or `""`
`message`	string	One sentence that explains the level
`reasons`	array of strings	MITRE's reasons, such as `Frequent Misuse` or `Abstraction`
`rationale`	string	MITRE's explanation
`options`	array of `[id, text]` pairs	Up to six alternatives: MITRE's suggestions with its comment or, when there are none, the entry's children with their name
`options_from`	string	Where the options come from: `MITRE`, `children`, or `""` when there are none
`more_options`	integer	How many alternatives there are beyond the six listed
`sources`	array of strings	For a CWE of a CVE, who links it to the CVE (as in Link); empty otherwise
`nvd_view`	boolean or null	Whether the weakness is in View 1003, the set the NVD uses to map vulnerabilities; `null` when it is not a weakness or the catalog has no such view

Detail section¶

details of a CWE record: one object per section of the catalog entry, in the same order as on cwe.mitre.org.

Field	Type	Content
`title`	string	The section: `Alternate Terms`, `Common Consequences`, `Potential Mitigations`, `Demonstrative Examples`, `Observed Examples`, `References`…
`items`	array	The entries of the section
`items[].head`	string	The entry's heading, such as `Example 1`, a CVE ID or an alternate term; `""` if it has none
`items[].fields`	array of `[label, value]` pairs	Labeled values, such as `["Impact", "Read Application Data"]` or `["Link", "https://…"]`
`items[].blocks`	array	The text, in order: a paragraph is an object with `p` (the text); a code snippet has `code` (the code, with its line breaks and indentation) and `label` (its kind and language, such as `"Bad · PHP"`)

{"title": "Demonstrative Examples",
 "items": [{"head": "Example 1", "fields": [],
            "blocks": [{"p": "The following code displays a welcome message on a web page based on the HTTP GET username parameter (covers a Reflected XSS (Type 1) scenario)."},
                       {"code": "$username = $_GET['username'];\necho '<div class=\"header\"> Welcome, ' . $username . '</div>';",
                        "label": "Bad · PHP"}]}]}

CVE record¶

cve in the cve and cve-relatives outputs: the CVE as merged from CVE.org, the NVD, FIRST and the CWE catalog (see How CVEs are linked to CWEs).

Field	Type	Content
`id`	string	CVE ID
`state`	string	`PUBLISHED`, `REJECTED`, or `""` when only the CWE catalog knows the CVE
`published`	string	Publication date
`assigner`	string	Short name of the CNA that published it, such as `apache`
`title`	string	The CNA's title; `""` if it gave none
`description`	string	The English description
`cvss`	array of CVSS scores	Every score, with its source
`mappings`	array of links	Every CWE linked to the CVE, with who links it
`kev`	KEV entry or null	`null` if the CVE is not in CISA's Known Exploited Vulnerabilities catalog
`ssvc`	SSVC assessment or null	`null` if CISA has not assessed it
`epss`	EPSS score or null	`null` if FIRST has no score for it (or could not be reached: see `notes`)
`notes`	array of strings	Problems found, such as a source that could not be reached or a cached copy being used
`url`	string	Its page on cve.org
`nvd_url`	string	Its page on the NVD

CVSS score¶

Field	Type	Content
`version`	string	`4.0`, `3.1`, `3.0` or `2.0`
`score`	string	Base score, such as `"10.0"`
`severity`	string	`Critical`, `High`, `Medium`, `Low` or `None`
`vector`	string	The CVSS vector; `""` if the source gave none
`source`	string	Who gives the score: `apache (CNA)`, `CISA-ADP`, `NVD`…

Link¶

Field	Type	Content
`ref`	string	`"CWE-502"`, or an NVD value: `NVD-CWE-noinfo` or `NVD-CWE-Other`
`cwe`	integer or null	The CWE number; `null` for NVD values
`sources`	array of strings	Who makes the link: `<CNA> (CNA)` (such as `apache (CNA)`), an ADP's short name (`CISA-ADP`), `NVD`, `<source> (via NVD)` when CVE.org could not be reached, or `CWE catalog (observed example)`
`in_view`	boolean	Whether the CWE is part of the view (View 1000 unless `--view`), and so can be placed in the hierarchy
`note`	string or null	Why it cannot be placed in the view; `null` when it can
`mapping_usage`	string	MITRE's mapping usage of the CWE; `""` if it is not in View 1000

KEV entry¶

Field	Type	Content
`date_added`	string	When CISA added the CVE to its catalog
`due_date`	string	The deadline CISA set for US federal agencies to fix it; `""` if unknown
`name`	string	CISA's name for the vulnerability; `""` if unknown
`required_action`	string	What CISA asks agencies to do; `""` if unknown
`url`	string	CISA's catalog, filtered to this CVE
`sources`	array of strings	Where the entry was found: `CISA-ADP` (the CVE.org record), `NVD`

SSVC assessment¶

Field	Type	Content
`options`	array of `[decision point, value]` pairs	As CISA publishes them, such as `["Exploitation", "active"]`, `["Automatable", "yes"]` and `["Technical Impact", "total"]`
`version`	string	Version of the SSVC decision tree
`date`	string	Date of the assessment
`source`	string	Who made it: `CISA-ADP`

EPSS score¶

Field	Type	Content
`score`	number	Probability, from 0 to 1, that the CVE is exploited in the next 30 days
`percentile`	number	From 0 to 1: the share of scored CVEs with a lower or equal score
`date`	string	The day FIRST calculated the score

A CWE¶

cwex 79 --json, type cwe: everything about one weakness. --depth N limits descendants (every level by default).

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"cwe"`
`id`	integer	CWE number
`cwe`	string	Its label, `"CWE-79"`
`name`	string	Name of the weakness
`url`	string	Its page on cwe.mitre.org
`catalog`	catalog
`abstraction`, `abstraction_info`	string	`Pillar`, `Class`, `Base`, `Variant` or `Compound`, and what it means
`structure`, `structure_info`	string	`Simple`, `Composite` or `Chain`, and what it means
`status`, `status_info`	string	As in the weakness summary, and what it means
`published`	string	Release date of the catalog version in which it first appeared
`published_in`	string	That catalog version, such as `"Draft 3"` or `"4.1"`
`description`, `extended_description`	string	As published by MITRE
`mapping`	verdict	Plus `comments` (string: MITRE's comments on mapping) and `suggestions`: every CWE that MITRE suggests instead, not only the six of `options`, as objects with `id` and `comment`
`lineages`	array of arrays of integers	Every path from the top of the hierarchy to the CWE, the primary one first
`lineage_warning`	string or null	Why the primary lineage does not reach a pillar; `null` when it does
`parents`	array	Weakness summaries of the direct parents, with `primary` (boolean): whether it is the primary parent
`children`	array of weakness summaries	Direct children
`ancestors`	array of relatives	Every ancestor
`descendants`	array of relatives	Every descendant, or as many levels as `--depth`
`descendants_depth`	integer or `"all"`	The depth used for `descendants`
`relations`	array	Other relationships: `nature` (`CanPrecede`, `CanFollow`, `Requires`, `StartsWith`, `PeerOf`, `CanAlsoBe` or `Overlaps`), `label` (`Can precede`…), `id` and `name` of the other weakness (`""` if it is not in View 1000)
`observed_cves`	array of strings	CVEs that the entry cites as observed examples
`views`	array of view memberships	The other views that contain the weakness: the featured ones first (the latest CWE Top 25, the latest OWASP Top Ten and the NVD's View 1003), then by view ID
`details`	array of detail sections	Every section of the catalog entry, as with `--detailed`

View membership¶

An item of views in a CWE record: a view, other than View 1000, that contains the weakness, directly or through its groupings.

Field	Type	Content
`id`	integer	The view's ID
`name`	string	Its name, such as `"Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses"`
`featured`	string or null	`top25` (the latest CWE Top 25), `owasp` (the latest OWASP Top Ten), `nvd` (View 1003), or `null` for any other view
`rank`	integer or null	In a CWE Top 25 list, the weakness's position in it; `null` otherwise
`groups`	array	The view's top-level groupings that contain the weakness, as objects with `id` and `name`, such as the OWASP category `A05:2025 - Injection`

{
  "schema": 1,
  "type": "cwe",
  "id": 79,
  "cwe": "CWE-79",
  "name": "Improper Neutralization of Input During Web Page Generation",
  "url": "https://cwe.mitre.org/data/definitions/79.html",
  "catalog": {"name": "CWE", "version": "5.0", "date": "2026-10-28", "view": "1000", "view_name": "Complete Weakness Hierarchy"},
  "abstraction": "Base",
  "status": "Stable",
  "published": "2006-07-19",
  "published_in": "Draft 3",
  "mapping": {"ref": "CWE-79", "cwe": 79, "level": "ok", "usage": "Allowed", "…": "…"},
  "lineages": [[707, 74, 79]],
  "lineage_warning": null,
  "parents": [{"id": 74, "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component",
               "abstraction": "Class", "status": "Incomplete", "published": "2006-07-19",
               "mapping_usage": "Discouraged", "url": "https://cwe.mitre.org/data/definitions/74.html", "primary": true}],
  "relations": [{"nature": "CanPrecede", "label": "Can precede", "id": 494, "name": "Download of Code Without Integrity Check"}],
  "observed_cves": ["CVE-2006-3211", "CVE-2006-3295", "…"],
  "views": [{"id": 1435, "name": "Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses",
             "featured": "top25", "rank": 1, "groups": []},
            {"id": 1450, "name": "Weaknesses in OWASP Top Ten RC1 (2025)", "featured": "owasp", "rank": null,
             "groups": [{"id": 1440, "name": "OWASP Top Ten 2025 Category A05:2025 - Injection"}]}, "…"],
  "details": ["…"]
}

(Shortened: "…" stands for fields and items left out.)

A CVE¶

cwex CVE-2021-44228 --json, type cve: the CVE, the mapping check of its links and the full record of each linked CWE. --depth N limits the descendants of those records.

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"cve"`
`catalog`	catalog
`cve`	CVE record	The merged record, with the exploitation signals
`mapping_check`	object	`verdicts`: a verdict for each link, in the order of `cve.mappings`. `disagreements`: array of strings, one per pair of sources whose CWEs fall in different branches of the hierarchy
`weaknesses`	array of CWE records	One for each linked CWE that is part of View 1000

{
  "schema": 1,
  "type": "cve",
  "catalog": {"name": "CWE", "version": "5.0", "date": "2026-10-28", "view": "1000", "view_name": "Complete Weakness Hierarchy"},
  "cve": {
    "id": "CVE-2021-44228",
    "state": "PUBLISHED",
    "published": "2021-12-10",
    "assigner": "apache",
    "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
    "description": "Apache Log4j2 2.0-beta9 through 2.15.0 …",
    "cvss": [{"version": "3.1", "score": "10.0", "severity": "Critical",
              "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "CISA-ADP"}, "…"],
    "mappings": [{"ref": "CWE-502", "cwe": 502, "sources": ["apache (CNA)"], "in_view": true, "note": null,
                  "mapping_usage": "Allowed"}, "…"],
    "notes": [],
    "kev": {"date_added": "2021-12-10", "due_date": "2021-12-24",
            "name": "Apache Log4j2 Remote Code Execution Vulnerability", "required_action": "…",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228",
            "sources": ["CISA-ADP", "NVD"]},
    "ssvc": {"options": [["Exploitation", "active"], ["Automatable", "yes"], ["Technical Impact", "total"]],
             "version": "2.0.3", "date": "2025-02-04", "source": "CISA-ADP"},
    "epss": {"score": 0.99999, "percentile": 1.0, "date": "2026-11-03"},
    "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228",
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
  },
  "mapping_check": {
    "verdicts": [{"ref": "CWE-502", "cwe": 502, "level": "ok", "sources": ["apache (CNA)"], "…": "…"}, "…"],
    "disagreements": ["apache (CNA) (CWE-502, CWE-400, CWE-20) and NVD (CWE-917) point to different branches: none of these CWEs is an ancestor or descendant of the other source's."]
  },
  "weaknesses": [{"schema": 1, "type": "cwe", "id": 502, "cwe": "CWE-502", "…": "…"}, "…"]
}

Ancestors and descendants¶

cwex 79 --ancestors --json or --descendants, type relatives. --depth works as in the terminal: only the direct ones by default.

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"relatives"`
`id`	integer	The queried CWE
`cwe`	integer	The same number, kept from earlier versions
`name`, `abstraction`	string	The queried CWE's name and abstraction
`mode`	string	`ancestors` or `descendants`
`depth`	integer or `"all"`	Levels walked
`view`	string	The view used, as in `catalog.view`
`catalog`	catalog
`count`	integer	Number of results
`results`	array of relatives	Ordered by distance
`note`	string or null	Explains an empty result (a pillar has no ancestors, a leaf no descendants) or an incomplete lineage; `null` otherwise

{
  "schema": 1,
  "type": "relatives",
  "id": 79,
  "cwe": 79,
  "name": "Improper Neutralization of Input During Web Page Generation",
  "abstraction": "Base",
  "mode": "ancestors",
  "depth": 1,
  "view": "1000",
  "catalog": {"name": "CWE", "version": "5.0", "date": "2026-10-28", "view": "1000", "view_name": "Complete Weakness Hierarchy"},
  "count": 1,
  "results": [
    {"id": 74, "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component",
     "abstraction": "Class", "status": "Incomplete", "published": "2006-07-19", "mapping_usage": "Discouraged",
     "url": "https://cwe.mitre.org/data/definitions/74.html",
     "distance": 1, "via": [79], "primary_parent": true, "primary_lineage": true}
  ],
  "note": null
}

Ancestors and descendants of a CVE¶

cwex CVE-2021-44228 --ancestors --json or --descendants, type cve-relatives: the same listing for each CWE linked to the CVE.

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"cve-relatives"`
`catalog`	catalog
`mode`	string	`ancestors` or `descendants`
`depth`	integer or `"all"`	Levels walked
`cve`	CVE record	The merged record, with the exploitation signals
`weaknesses`	array	One `relatives` output for each linked CWE that is part of View 1000

Mapping check¶

cwex --check 20 79 CVE-2021-44228 --json, type check: whether each CWE, or each CWE of each CVE, should be used to map vulnerabilities. The exit status is 1 when passed is false.

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"check"`
`catalog`	catalog
`passed`	boolean	`false` when a verdict is `error` or `prohibited` (also `discouraged` with `--strict`), or a CVE could not be looked up. Links that come only from the catalog's observed examples do not count
`strict`	boolean	Whether `--strict` was given
`checks`	array	One per CVE, and one for each run of consecutive CWEs given on the command line
`checks[].input`	string or null	The CVE as given; `null` for a group of CWEs
`checks[].error`	string or null	Why the CVE could not be looked up; `null` otherwise
`checks[].cve`	object or null	The CVE's `id` and `summary` (its title or, if it has none, its description); `null` for a group of CWEs
`checks[].verdicts`	array of verdicts	One per CWE, or per link of the CVE
`checks[].disagreements`	array of strings	For a CVE, the pairs of sources whose CWEs fall in different branches

{
  "schema": 1,
  "type": "check",
  "catalog": {"name": "CWE", "version": "5.0", "date": "2026-10-28", "view": "1000", "view_name": "Complete Weakness Hierarchy"},
  "passed": true,
  "strict": false,
  "checks": [
    {"input": null, "error": null, "cve": null, "disagreements": [],
     "verdicts": [
       {"ref": "CWE-20", "cwe": 20, "name": "Improper Input Validation", "level": "discouraged",
        "usage": "Discouraged", "message": "Discouraged: should not be used to map real-world vulnerabilities.",
        "reasons": ["Frequent Misuse", "Frequent Misinterpretation", "Abstraction"],
        "rationale": "CWE-20 is commonly misused in low-information vulnerability reports …",
        "options": [[1173, "Not Using an Input Validation Framework"], [116, "Improper Encoding or Escaping of Output"], "…"],
        "options_from": "MITRE", "more_options": 3, "sources": []},
       {"ref": "CWE-79", "cwe": 79, "level": "ok", "usage": "Allowed", "…": "…"}]}
  ]
}

CVEs of a CWE¶

cwex 79 --cves --json, type cwe-cves: how many CVEs in the NVD list the CWE, and the most recent ones (see CVEs of a CWE).

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"cwe-cves"`
`catalog`	catalog
`source`	string	Always `"NVD"`
`id`	integer	The CWE number
`cwe`	string	Its label, `"CWE-79"`
`name`	string	Name of the weakness
`since`	string or null	The `--since` date; `null` for every date
`counted`	string	When the NVD was asked, in UTC (`"2026-11-04 12:41 UTC"`). Counts are cached for a day
`count`	integer	CVEs in the NVD whose weaknesses include the CWE (published since `since`, if given)
`recent`	array	The `--limit` most recent CVEs (20 by default), newest first
`recent[].id`	string	CVE ID
`recent[].published`	string	Publication date
`recent[].status`	string	The NVD's analysis status: `Received`, `Awaiting Analysis`, `Undergoing Analysis`, `Analyzed`, `Modified`, `Deferred` or `Rejected`
`recent[].cvss`	object or null	The newest CVSS score, the NVD's own when there is one: `version`, `score` and `severity` as in CVSS score
`recent[].kev`	string	Date it was added to CISA's KEV catalog; `""` if it is not in it
`recent[].description`	string	The English description
`by_cwe`	array	Only with `--include-descendants`: the CWE and each descendant as a weakness summary with its `count`. The CWE comes first, then the descendants from the largest count
`notes`	array of strings	Problems found, such as a cached count used because the NVD could not be reached

{
  "schema": 1,
  "type": "cwe-cves",
  "catalog": {"name": "CWE", "version": "5.0", "date": "2026-10-28", "view": "1000", "view_name": "Complete Weakness Hierarchy"},
  "source": "NVD",
  "id": 79,
  "cwe": "CWE-79",
  "name": "Improper Neutralization of Input During Web Page Generation",
  "since": null,
  "counted": "2026-11-04 12:41 UTC",
  "count": 25193,
  "recent": [
    {"id": "CVE-2026-97397", "published": "2026-11-04", "status": "Deferred",
     "cvss": {"version": "3.1", "score": "7.2", "severity": "High"}, "kev": "",
     "description": "The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting …"},
    "…"
  ],
  "notes": []
}

Search¶

cwex --search sql --json, type search: weaknesses whose name contains the text. The exit status is 1 when there are no results. --limit N changes how many are listed (25 by default; 0 only counts them).

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"search"`
`catalog`	catalog
`query`	string	The text searched for
`total`	integer	How many weaknesses match, including those left out by `--limit`
`results`	array of weakness summaries	Up to `--limit` (25 by default): names with the text as a whole word first, then those with it inside another word; in each group, names that start with the text first, then by CWE number

Views¶

cwex --views --json, type views: the views of the catalog, and whether they can be browsed with --view.

Field	Type	Content
`schema`, `type`	integer, string	`1`, `"views"`
`catalog`	catalog
`views`	array	Every view, by ID
`views[].id`	integer	The view's ID
`views[].name`	string	Its name
`views[].type`	string	`Graph` (a hierarchy of its own), `Explicit` (a list of entries) or `Implicit` (defined by a filter on the catalog)
`views[].status`	string	As in the weakness summary
`views[].members`	integer	How many entries the view lists at its top level
`views[].browsable`	boolean	Whether `--view` can show it: `false` for views defined by a filter and views without members
`views[].featured`	string or null	`top25`, `owasp` or `nvd` for the featured views, as in view membership; `null` otherwise

With jq¶

A few examples with jq:

# Is Log4Shell known to be exploited, and how likely is exploitation?
cwex CVE-2021-44228 --json | jq '{kev: .cve.kev.date_added, epss: .cve.epss.score}'

# Every CWE linked to a CVE, with who links it
cwex CVE-2021-44228 --json | jq -r '.cve.mappings[] | "\(.ref)\t\(.sources | join(", "))"'

# The primary lineage of CWE-79, as labels
cwex 79 --json | jq -r '.lineages[0] | map("CWE-\(.)") | join(" > ")'

# Which of the last 2,000 CVEs of CWE-502 are in the KEV catalog, and since when
cwex 502 --cves --limit 2000 --json | jq -r '.recent[] | select(.kev != "") | "\(.id) \(.kev)"'

# Fail a script when a CWE should not be used for mapping
cwex --check 20 79 --json | jq -e '.passed'

# Rank of a weakness in the latest CWE Top 25, if it is there
cwex 787 --json | jq '.views[] | select(.featured == "top25") | .rank'

# The OWASP Top Ten category of CWE-89
cwex 89 --json | jq -r '.views[] | select(.featured == "owasp") | .groups[].name'