Views

A view is a selection of CWE entries organized for a purpose. By default cwex uses View 1000, Complete Weakness Hierarchy, which holds every weakness. MITRE publishes 61 more: the CWE Top 25 of each year, the OWASP Top Ten, the reduced set the NVD maps vulnerabilities to, weaknesses grouped by topic, coding standards… This page explains how to find them and open them in the terminal and in the browser.

In short

cwex --views                     # list the views and their IDs
cwex --view 1435                 # open a view in the terminal: the 2025 CWE Top 25
cwex --view 1450 --tui           # explore it interactively in the terminal
cwex --view 1450 --web           # open it as a graph in the browser
cwex 79 --view 1450              # a weakness inside a view (also --tui, --web)

Add --view ID to any command to use that view instead of View 1000. Without a CWE, cwex shows the whole view.

Views worth knowing

ID	View	What it is for	Structure
1435	2025 CWE Top 25 Most Dangerous Software Weaknesses	The 25 weaknesses behind the most damaging vulnerabilities of the year. 1430 is 2024's, 1425 2023's…	A list of 25, in rank order
1450	OWASP Top Ten RC1 (2025)	The OWASP Top Ten categories of web risks and their weaknesses. 1344 is the 2021 edition	10 categories, 246 weaknesses
1003	Weaknesses for Simplified Mapping of Published Vulnerabilities	The reduced set the NVD uses to classify vulnerabilities	Two levels, 130 weaknesses
699	Software Development	Weaknesses by development concept: API errors, authentication, concurrency…	40 groupings, 405 weaknesses
1194	Hardware Design	Hardware weaknesses by topic	13 groupings, 112 weaknesses
1400	Comprehensive Categorization for Software Assurance Trends	Every weakness in exactly one of 22 categories, for statistics	22 groupings, every weakness
1154, 1133, 1449	SEI CERT C, SEI CERT Java, OpenSSF Secure Coding Guide for Python	The weaknesses each coding standard addresses, by chapter	Groupings per chapter
884	CWE Cross-section	A representative sample of 157 weaknesses	A list

The counts are those of CWE 5.0. cwex --views lists every view of the catalog you have.

Find a view

cwex --views lists the 62 views with their ID, type, status and name. The three featured views (the latest CWE Top 25, the latest OWASP Top Ten and the NVD's View 1003) are highlighted, and the ones that cannot be opened say why.

cwex --views, shortened (… marks the lines left out). The type says how a view is built: Graph and Explicit views list their entries and can be opened; Implicit views are a filter on the whole catalog and cannot.

With --json, the list includes for each view whether it can be opened (browsable) and which featured view it is (see Views in the JSON reference):

cwex --views --json | jq -r '.views[] | select(.browsable) | "\(.id)\t\(.name)"'

Open a view in the terminal

The whole view

cwex --view ID prints the view's card and its tree. The view itself is the root (Vw), and below it come the entries it lists, in the order MITRE gives them: in a Top 25, the order of the ranking.

cwex --view 1435, shortened: the 2025 CWE Top 25 from number 1 (CWE-79) down. The right-hand columns show, as in View 1000, the mapping mark, the status and the year of publication.

By default the tree shows the view and its first level. --depth shows more:

cwex --view 699                  # the 40 groupings of Software Development
cwex --view 699 --depth 2        # ...and the weaknesses in each one
cwex --view 1003 --depth all     # every level

In views organized by topic, the groupings (formerly categories, Gr) are part of the tree. Their names are shortened in the rows when they all start the same way: A05:2025 - Injection instead of OWASP Top Ten 2025 Category A05:2025 - Injection.

A weakness inside a view

Give a CWE with --view to see where that view places it: its card and its lineage in the view.

cwex 79 --view 1450

Hierarchy in View 1450 (CWE 5.0, depth 2)
Vw CWE-1450  Weaknesses in OWASP Top Ten RC1 (2025)                                ✗ Incomplete 2025
└─ Gr CWE-1440  OWASP Top Ten 2025 Category A05:2025 - Injection                   ✗ Incomplete 2025
   └─ Ba CWE-79    Improper Neutralization of Input During Web Page Generation  ◀    Stable     2006

If the view does not include the CWE, cwex says so: CWE-80 (…) is not part of View 1003. To know in advance which featured views include a weakness, look at the Member of line of its card (see below).

Interactive

--tui opens the view in the interactive explorer, with the same keys as for View 1000: arrows or the mouse to select, Enter to center the hierarchy on an entry, + and - for more or fewer levels, / to jump to another CWE of the view.

cwex --view 1450 --tui           # the whole view
cwex 79 --view 1450 --tui        # centered on CWE-79

cwex --view 1450 --tui. The header says which view is open. The ten categories of the OWASP Top Ten 2025 hang from the view, each with the number of weaknesses it holds; the card on the right is that of the selected category, A05:2025 - Injection.

Press w to open the same view, centered on the selected entry, in the browser.

Lists, search and CVEs

The other modes also take --view:

cwex --view 1435 --descendants              # the 25 weaknesses of the Top 25, as a list
cwex --view 699 --descendants --depth all   # every entry of Software Development
cwex 79 --view 699 --ancestors              # the groupings that contain CWE-79
cwex --view 1003 --search command           # search by name, only inside the view
cwex CVE-2021-44228 --view 1003             # where the NVD's view places Log4Shell's CWEs

Open a view in the browser

--web writes the view as a single HTML page and opens it:

cwex --view 1435 --web                            # the whole view
cwex 79 --view 1450 --web                         # centered on CWE-79
cwex --view 699 --web -o 699.html --no-open       # save it without opening it

Pages are saved in ~/.cache/cwe-explorer/html/ with the view in the name (view-1435.html, cwe-79-view-1450.html), unless -o gives another path.

cwex --view 1435 --web. The 2025 CWE Top 25 hangs from the view in rank order, and each node carries its rank (#5, #6…). The side panel shows CWE-787, number 5.

cwex --view 1450 --web, centered on CWE-79: it hangs from category A05:2025 - Injection. The headline says in View 1450 when the page is centered on an entry of a view other than 1000.

In the page everything works as with View 1000:

• +N on a grouping shows its weaknesses; double click centers the graph on an entry.
• The search box finds entries of this view, and the address (#cwe-79) opens one directly.
• Filter has the types of the view, groupings and the view itself included, so you can, for example, hide the groupings and keep only the weaknesses.
• The panel of each entry ends with the view's name.

A page holds one view. To see another, generate its page with --view. An entry that is not in the page's view is explained, and a link to a view says how to open it (cwex --view 699 --web).

Without changing the view

You do not need to open a view to know whether a weakness is in the featured ones. With View 1000, as always:

• The card says it under Member of: #1 in the 2025 CWE Top 25, OWASP Top Ten 2025: A05:2025 - Injection, View 1003, used by the NVD to map vulnerabilities.
• The browser shows the Top 25 rank on each node, and its Filter has a Member of section that keeps only the weaknesses of those views.
• --check notes the weaknesses that are not in the NVD's View 1003.
• The JSON record of a CWE lists every view that contains it (views).

More in Other views in the user guide.

In JSON

--view changes the view of every JSON output, and catalog.view says which one was used. For example, the 2025 Top 25 in rank order, and the OWASP category of each weakness:

cwex --view 1435 --descendants --json | jq -r '.results[] | "\(.id)\t\(.name)"'
cwex 89 --json | jq -r '.views[] | select(.featured == "owasp") | .groups[].name'

What cannot be opened

• Views defined by a filter (Implicit in cwex --views), such as Weaknesses in Software Written in C (658). They are an XPath query over the whole catalog, not a list of entries.
• Deprecated views without members, such as 630 and 631.
• View 1000 without a CWE. It has no single root: its ten pillars are the top. Give a CWE, or open a pillar: cwex 707.
• --check and --cves do not take --view: they always use the whole catalog.

The other limits, such as what a "lineage" means in a view by topic, are listed in Limitations.