Skip to content

Limitations

What the hierarchy and the CVE links can and cannot tell you. For how the tool works, see the User guide.

Ancestors and descendants

Both modes can be computed from the data MITRE publishes, but View 1000 is not a simple tree, and that shapes how the results should be read. Figures are from the CWE 5.0 catalog (2026-10-28).

  1. It is a graph with multiple parents, not a tree.
  2. 152 of the 957 weaknesses have more than one direct parent, up to 3 (CWE-396, CWE-397, CWE-415, CWE-425 and CWE-1299). Of the 1106 ChildOf links, 160 are secondary.
  3. That is why mode 1 can return several parents, and the full list of ancestors can span several branches: 279 weaknesses have more than one lineage and 235 reach more than one pillar (CWE-425 reaches three).
  4. MITRE only marks which parent is the primary one. The other parents have no order of importance.
  5. "Direct" means a ChildOf link, not the next abstraction level. Links do not always go down one step Pillar → Class → Base → Variant:
  6. 83 Bases and 3 Variants (CWE-580, CWE-581 and CWE-1077) hang directly from a Pillar, and 85 Variants hang from a Class.
  7. 177 links join weaknesses of the same type: 88 Base–Base, 62 Class–Class and 27 Variant–Variant.
  8. 2 Classes hang from a Base: CWE-114 from CWE-73 and CWE-240 from CWE-237.

The tool returns what the catalog publishes; it does not infer parents from the type. 3. The same ancestor can be at several distances. - In 25 weaknesses there are paths of different lengths to the same ancestor. For example, CWE-102 reaches CWE-707 in 3 levels and also in 4. - In 4 cases, a direct parent is also a more distant ancestor (CWE-240, CWE-415, CWE-425 and CWE-1262).

Each node appears only once, at the shortest distance, and via tells how it is reached. --depth N also counts levels along the shortest path. The other paths are visible with cwex <id>, which draws every lineage, or in the web graph. 4. View 1000 by default, and only ChildOf in it. - Other views have their own hierarchy. Some use ChildOf with another View_ID (for example 1003, the one the NVD uses, or 1305). Others are organized with groupings and Has_Member (for example 699). --view ID browses them (see Other views); the limits are listed in Other views below. - The 431 groupings (formerly Categories) and the 62 views are not weaknesses. In View 1000, if you query one, the tool explains what it is and exits with an error instead of listing its members. In the views that contain them, they are nodes. - The XML does not publish ParentOf relationships: children are obtained by inverting the ChildOf links. 5. Other relationships are not kinship. CanPrecede (148), PeerOf (103), CanAlsoBe (28), Requires (13), StartsWith (3) and Overlaps (3) are not hierarchical and are not followed. They appear in each CWE's details (cwex <id>). 6. Compounds have no children. The 7 Compound weaknesses (for example CWE-352) are leaves of View 1000, because their components are linked with Requires or StartsWith. Mode 2 explains this and names those components, but does not count them as descendants. 7. Some empty results are expected. The 10 Pillars have no ancestors, and 692 weaknesses have no descendants: 390 Bases, 274 Variants, 21 Classes and the 7 Compounds. In those cases the tool adds a note (note in JSON) and exits with code 0. 8. Deprecated entries. The 27 deprecated entries outside the view cannot be queried. The exception is CWE-377: it is deprecated, but CWE-378 and CWE-379 still hang from it. So their ancestors stop at CWE-377, with an incomplete lineage warning. 9. Results depend on the catalog version. MITRE changes relationships between versions. The tool uses the cached copy until you run cwex --update.

Other views

  • Views defined by a filter cannot be browsed. 17 of the 62 views, such as Weaknesses in Software Written in C (658), are an XPath filter over the whole catalog rather than a list of members. cwex --views marks them, along with the deprecated views that have no members.
  • Lineages in views by topic. In views built from groupings (699, 1194, 1400…), a weakness can belong to several groupings: 39 weaknesses do in 699. Their "lineages" are the groupings that contain them, and the first one listed counts as primary, because MITRE does not mark one.
  • The Top 25 rank comes from the order of the list. The XML has no rank field; the tool uses the position of each weakness in the view's members. It matches the published rankings of 2023, 2024 and 2025, but MITRE could change the order.
  • Featured views are found by name. The latest Top 25 and OWASP Top Ten are the views whose names match those lists with the latest year, and View 1003 is found by its name. A view renamed by MITRE would no longer be featured.
  • --check and --cves ignore --view. The mapping guidance belongs to each entry, whatever the view, and the NVD counts CVEs per CWE.

These limitations come from the sources themselves. How the tool reads and merges them is explained in How CWE Explorer links CVEs to CWEs.

  • Sources disagree. For Log4Shell, Apache assigns CWE-502, CWE-400 and CWE-20 while the NVD assigns CWE-917. The tool shows all of them with their source instead of choosing one.
  • Many CVEs have no CWE from their CNA, especially older ones: Heartbleed's record says n/a, and only CISA, the NVD and the catalog link it to CWE-125. Some CVEs have no CWE at all.
  • Some links cannot be placed in View 1000. The NVD sometimes uses NVD-CWE-noinfo or NVD-CWE-Other instead of a CWE, and some links point to groupings (formerly categories) or deprecated entries. They are listed with an explanation but have no place in the hierarchy.
  • Observed examples are citations, not official links. CWE authors pick them to illustrate a weakness, so they often point to a more specific or more general CWE than the official one: Heartbleed is cited under CWE-125, CWE-126, CWE-130 and CWE-240.
  • Lookups need network access to CVE.org and the NVD, and the NVD limits anonymous clients to 5 requests every 30 seconds.

Exploitation signals

  • KEV is CISA's view. Its catalog lists vulnerabilities with reliable evidence of exploitation in the wild. A CVE that is not in it may still be exploited.
  • EPSS is a model. FIRST recalculates the scores every day, so a score is only meaningful with its date, and new CVEs may not have one yet.
  • SSVC is not always there. It appears only when CISA has added an assessment to the CVE record, and its options follow the version of the decision tree CISA used.

CVEs of a CWE

--cves and the CVEs in the NVD section of the browser ask the NVD, so:

  • Only the NVD counts. A CVE is counted when the NVD lists the CWE among its weaknesses. That list holds the NVD's own CWEs and copies of those of the CNA, so it is close to "any source", but it does not include the catalog's observed examples, and a CVE that the NVD has not processed yet may be missing.
  • A count is not a measure of danger. It reflects how CVEs are mapped: generic CWEs such as CWE-20 or CWE-400 collect many mappings that a careful analyst would make more specific, and Discouraged or Prohibited entries are still used.
  • The NVD maps with a small set of CWEs. Its analysts use view 1003, about 130 weaknesses, so the more specific entries of View 1000 get few CVEs. Under CWE-119, CWE-787 Out-of-bounds Write has 13,272 CVEs, but CWE-122 Heap-based Buffer Overflow, a child of CWE-787 and CWE-788, has 33, and ten descendants have none (counted on 2026-11-04).
  • Descendants are counted separately. With --include-descendants, a CVE linked to several of the CWEs is counted once for each, so the sum is an upper bound.
  • Placeholders are not covered. NVD-CWE-noinfo and NVD-CWE-Other, which the NVD uses when no CWE fits, are not CWEs and cannot be queried with --cves.
  • It takes time without an API key. Each count or page is one request, and the NVD allows 5 every 30 seconds without a key. A long --since period (split into 120-day ranges) or --include-descendants on a large class can take minutes.