Features

Everything CWE Explorer can do, with an example of each. The User guide explains every option in detail.

Look up a CWE in the terminal

cwex 79 prints the weakness's card: its type, structure, status, publication date, whether MITRE recommends using it to map vulnerabilities, its description and its relationships. Below the card, a tree shows where it sits in View 1000: its lineage up to the top of the hierarchy and, by default, two levels of descendants.

cwex 79. The card of CWE-79 and its place in View 1000: lineage up to the pillar CWE-707 and two levels of descendants. The columns on the right show each entry's mapping mark (! discouraged), its status and the year it was published.

A CWE can be written as 79, CWE-79 or cwe79. If the ID belongs to a grouping, a view or a deprecated entry, cwex explains why it is not part of View 1000. --depth changes how many levels of descendants are shown (--depth all for every one), and --search "race" finds weaknesses by name.

Explore in the terminal

cwex 79 --tui opens an interactive explorer: the hierarchy on the left and the card of the selected entry on the right. Move with the arrow keys or the mouse, press Enter to re-center the hierarchy on an entry, b to go back, + and - to show more or fewer levels, and / to jump to another CWE or to a CVE.

cwex 693 --tui. The interactive explorer on CWE-693 Protection Mechanism Failure, with CWE-347 selected. The header explains the type badges and the right-hand columns.

More: The interactive explorer.

Explore in the browser

cwex 79 --web draws the hierarchy as an interactive graph and opens it in the browser. Click a node to see its details and highlight its lineage, double-click it to rebuild the graph around it, and use +N on a node to expand its children.

cwex 79 --web. The graph of CWE-79 with CWE-83 selected: the side panel shows its details and the thick line marks its lineage. Every node shows its status and the year it was published.

The page is a single HTML file that embeds all of View 1000, so it works without a connection and can be shared. More: The browser.

Search

The search box jumps to any CWE by ID or name. Typing a CVE ID looks it up online from the page itself and links it to its CWEs, without going back to the terminal.

Searching by name: sql lists the weaknesses whose name mentions it, with their type.

Typing a CVE ID offers to look it up on CVE.org and the NVD and add it to the graph.

Filters

The Filter button keeps the graph to the weaknesses that matter: by type, status, mapping usage or year of publication. The rest are dimmed, so the hierarchy keeps its shape, or hidden, so only the matching weaknesses remain. The filters travel in the address, so a filtered view can be shared.

CWE-74 with the filter Mapping: Allowed. The weaknesses that MITRE allows only after review, such as CWE-77, CWE-91 and CWE-94, are dimmed, and so are the discouraged CWE-74 and CWE-707; 27 of the 35 shown match.

The same filter with Hide them. The hidden classes give way to their children, which hang from CWE-74 through dotted edges.

More: Filters.

Full screen

The full-screen button (or the F key) gives the whole window to the graph. The details of a node then open in a floating panel, closed with × or Esc.

Full screen on CVE-2021-44228, with CWE-20 selected. The details, including MITRE's mapping guidance, open in a floating panel over the graph.

Dark mode and phones

The page follows the system's dark mode and adapts to small screens, where the details move below the graph.

Dark mode, on CVE-2021-44228 with CWE-502 selected: its lineage up to the pillar CWE-664 is highlighted in the graph and listed in the panel.

CWE-79 on a phone: the search box and the depth selector stack above the graph, and the details follow below it.

Look up a CVE

Every mode also accepts a CVE: cwex CVE-2021-44228. CWE Explorer downloads the record from CVE.org and the NVD, collects the CWEs that each source links to the vulnerability, and places all of them in the same hierarchy. Each link says who made it: the organization that published the CVE (its CNA), CISA, the NVD, or the CWE catalog, which lists the CVE as an observed example.

cwex CVE-2021-44228 (Log4Shell). The card of the CVE, with its CVSS scores and the five CWEs linked to it and who links each one, followed by the hierarchy that joins them (◀ marks the linked CWEs). The card of each CWE, printed in between, is left out here.

cwex CVE-2021-44228 --tui. The CVE is the first row of the explorer, above the CWEs linked to it. Pressing / looks up another CVE without leaving the explorer.

cwex CVE-2021-44228 --web. The CVE is one more node (the dark one on the right), linked to its five CWEs; the KEV tag says it is known to be exploited. Its panel shows the CVSS scores and the exploitation signals.

Is it being exploited?

CVSS says how severe a vulnerability is, not how likely it is to be attacked. The CVE card adds three signals: whether the CVE is in CISA's Known Exploited Vulnerabilities catalog (KEV), CISA's SSVC assessment, and FIRST's EPSS probability of exploitation in the next 30 days.

The card of Log4Shell in the terminal (the description is left out). It has been in the KEV catalog since 2021-12-10, CISA assessed its exploitation as active and automatable, and EPSS gives it a 99.999% chance of being exploited in the next 30 days.

The same signals in the panel of the CVE in the browser, with a link to its KEV entry. The page asks FIRST for the EPSS score itself.

More: Exploitation signals.

When the sources disagree

The organization that published the CVE and the NVD often choose different CWEs. When their choices fall in different branches of the hierarchy (none is an ancestor or descendant of another), CWE Explorer warns about it. Each linked CWE also carries MITRE's mapping advice, so a CWE that should not be used to classify vulnerabilities is easy to spot.

The Weaknesses section of CVE-2021-44228 in the browser. Apache, the CNA, links CWE-502, CWE-400 and CWE-20; the NVD links CWE-917. MITRE discourages CWE-400, CWE-20 and CWE-74 for mapping and suggests more specific entries, and the warning at the bottom says that the sources point to different branches.

More: CVEs and How CVEs are linked to CWEs.

Find the CVEs of a CWE

cwex 79 --cves goes the other way: it asks the NVD how many CVEs have the weakness and lists the most recent ones. --since limits it to a period, and --include-descendants adds the count of every weakness below it.

cwex 79 --cves --limit 8. 25,193 CVEs in the NVD list CWE-79, and the eight most recent, all published that day, with their CVSS score and the start of their description.

In the browser, the CVEs in the NVD section of a CWE asks for the same count and the 10 most recent CVEs. Clicking one opens it in the graph.

More: CVEs of a CWE.

Check whether a CWE should be used for mapping

MITRE marks each CWE as Allowed, Allowed-with-Review, Discouraged or Prohibited for mapping real-world vulnerabilities, and often explains why and suggests better entries. CWE Explorer shows this advice everywhere: as a mark in the trees, in every card and in the side panel of the browser.

The Mapping guidance of CWE-20 in the browser: why MITRE discourages it and the more specific weaknesses it suggests instead.

cwex --check reviews a list of CWEs and CVEs at once. It exits with an error when one of them is prohibited (or also discouraged, with --strict), so it can stop a pipeline that classifies vulnerabilities with the wrong CWE.

cwex --check 20 79. CWE-20 is discouraged, with MITRE's reasons and suggestions; CWE-79 is allowed. The check passes because nothing is prohibited.

More: Mapping guidance.

Read the full catalog entry

--detailed adds every section of the CWE catalog entry, in the same order as cwe.mitre.org: alternate terms, consequences, mitigations, demonstrative examples with their code, observed examples, detection methods, related attack patterns, references and more. It works with the tree, the interactive explorer and the browser.

cwex 79 --web --detailed. The catalog sections of CWE-79 as collapsible blocks in the side panel, with Demonstrative Examples open: bad code is marked in red and attacks in amber.

More: Full details.

List ancestors or descendants

--ancestors lists the weaknesses above a CWE and --descendants the ones below it, level by level. Each entry says through which CWE it is reached and whether it is on the primary lineage. A weakness can have several parents, so it can have more ancestors than its single lineage suggests.

cwex 425 --ancestors --depth all. CWE-425 Direct Request has three parents and eleven ancestors in total, from three different pillars. The primary lineage is shown in bold.

More: Ancestors and descendants.

Explore other views

View 1000 holds every weakness. MITRE also publishes views for a purpose: the CWE Top 25 of each year, the OWASP Top Ten, the reduced set the NVD maps vulnerabilities to (View 1003), weaknesses by topic (699, 1194)…

Top 25, OWASP Top Ten and the NVD's view

The card of every weakness says whether it is in the latest CWE Top 25 and at what rank, in which category of the latest OWASP Top Ten, and whether it is in the NVD's View 1003. --check also notes the weaknesses outside View 1003.

cwex 79. CWE-79 is number 1 in the 2025 CWE Top 25, belongs to category A05 (Injection) of the OWASP Top Ten 2025, and is in View 1003, which the NVD uses.

In the browser, the Top 25 rank is a tag on each node, and the Member of filter keeps only the weaknesses of those lists.

Every descendant of CWE-664 with the filter Member of: 2025 CWE Top 25 and Hide them: the 13 Top 25 weaknesses below the pillar, each with its rank (#5, #6…).

Browse another view

--view ID replaces View 1000 in every mode, and cwex --views lists the views that can be browsed. In views organized by topic, the groupings (formerly categories, Gr) become nodes, and the view itself is the root (Vw).

cwex --view 699. The Software Development view and its first level: 40 groupings, each with the number of weaknesses it holds (13 of them shown here).

cwex --view 1450 --web, centered on CWE-79: in the OWASP Top Ten 2025 it hangs from category A05:2025 - Injection. The headline says which view is shown, and the panel lists the featured views that contain the weakness.

More: Views, which explains how to open any view in the terminal and in the browser.

Export everything as JSON

--json prints everything CWE Explorer knows about a CWE or a CVE, for scripts and other tools: for a CVE, also its exploitation signals (KEV, SSVC and EPSS). Every other mode has its own JSON output, and all of them are described field by field in the JSON reference.

$ cwex 79 --json
{
  "schema": 1,
  "type": "cwe",
  "id": 79,
  "cwe": "CWE-79",
  "name": "Improper Neutralization of Input During Web Page Generation",
  "status": "Stable",
  "published": "2006-07-19",
  "mapping": { "usage": "Allowed", "level": "ok", ... },
  "lineages": [[707, 74, 79]],
  "ancestors": [{ "id": 74, "distance": 1, "primary_parent": true, ... }],
  "descendants": [ ... 8 weaknesses ... ],
  "observed_cves": ["CVE-2006-3211", "CVE-2006-3295", ... 20 CVEs ...],
  "details": [ ... every section of the catalog entry ... ],
  ...
}

An abridged excerpt of cwex 79 --json. For a CVE, the output holds the merged record with the exploitation signals, the mapping check and the full record of each linked CWE.

More: JSON reference.

Work offline

The CWE catalog is downloaded once and kept in a cache, so CWEs work without a connection afterwards; cwex --update downloads it again. CVE records are cached for seven days, EPSS scores and the CVEs of a CWE for one day, and an older copy is used when there is no connection. With an NVD API key, the NVD allows ten times as many lookups.

Read this documentation offline

cwex --docs serves this documentation from your computer and opens it in the browser. It is installed with the package, so it matches your version of cwex.