To mark the milestone, the CWE Program has published the CWE 20th Anniversary Report, a new retrospective on how CWE evolved from early efforts to organize software-security knowledge into a resource used today across vulnerability analysis, secure software and hardware development, research, tooling, standards, and education.

The report looks back at CWE’s origins and public launch, the growth of the knowledge base, the evolution of weakness prioritization and root-cause mapping, expansion into hardware security, and the role of community collaboration in shaping the Program. It also highlights how CWE is being used today and includes new data illustrating the growth of the corpus and its use over time.

Looking ahead, the report examines CWE 5.0, AI-assisted development and analysis, and the growing importance of structured weakness knowledge as software development becomes increasingly automated. The anniversary report reflects on what the community has built over the past twenty years — and how that knowledge can be used to help prevent recurring classes of vulnerabilities in the years ahead.

Read the CWE 20th Anniversary Report.

Among the most significant Schema 8.0 updates are a major terminology shift from “Category” to “Grouping,” the introduction of new elements such as Technical_Nuance and Dimensions to capture richer technical meaning, and expanded support for representing multiple submitters and contributors more accurately. The new schema also strengthens relationship modeling by allowing dimensions and notes on relationships and by adding an Overlaps relationship type, while introducing more flexible lifecycle support through Custom_Phases for domains such as AI and hardware. In addition, Mode_of_Introduction and Detection_Method entries can now include multiple phases, and several naming and metadata updates, including namespace and note enhancements. Some of the changes are breaking changes. See more below.

While a few additional minor updates may still be introduced in September 2026, the current draft of Schema 8.0 is considered fairly stable, and consumers are encouraged to begin reviewing the changes now.

BREAKING CHANGES

Supporting Existing Consumers with Parallel 7.x Releases

To help minimize disruption for current users, the CWE Program will continue to provide data in the Schema 7.x format alongside the new Schema 8.0 content.

CWE 5.0 will use Schema 8.0 in order to better express new concepts being added to the corpus. At the same time, the program will continue publishing Schema 7.x-compatible releases for organizations and tools that depend on the existing format. These schema-7-only releases will continue the CWE 4.x versioning pattern, with CWE 4.21 planned as a parallel release to CWE 5.0.

This means existing integrations are unlikely to break immediately, although newer 8.x-only concepts may be harder to extract from the 7.x representation. In those cases, the additional information will generally appear as supplementary Notes in the 7.x-formatted content.

What This Means for Consumers

Organizations that use CWE data in security tools, reporting pipelines, content analysis, or internal knowledge systems should begin evaluating Schema 8.0 now. Even with the availability of parallel Schema 7.x releases, the new schema introduces important structural and naming changes that may require updates to parsers, validators, mappers, and downstream processing logic.

At the same time, the parallel release strategy should give consumers time to adapt without disrupting existing workflows.

MAIN CHANGES

A Major Terminology Change: “Category” Becomes “Grouping”

One of the most visible changes in Schema 8.0 is the replacement of the term “Category” with “Grouping.”

This change is intended to reduce longstanding community confusion between categories and classes. As part of this update:

• The Category element will be removed and replaced with Grouping

Any consumers that reference these element names directly should plan for updates.

New Elements for Richer Technical Meaning

Schema 8.0 introduces new elements designed to better capture nuance and structure within CWE entries.

• Technical_Nuance — A new Technical_Nuance element will provide focused explanations or technical details related to a weakness. This should help consumers better understand finer-grained distinctions and contextual details.
• Dimensions — The new Dimensions element identifies the key aspects of a weakness that a CWE entry focuses on, such as behavior, resource, or technology type or property. Making these aspects explicit can improve precision and support more sophisticated analysis.

Expanded Content History Support

Schema 8.0 improves how contributions and submissions are represented.

• More than one Submission element can now be used
• More than one Submission_Name can be used within each Submission
• More than one Contribution_Name can be used within a Contribution element

These changes make it easier to accurately represent multiple submitters and contributors without relying on comma-separated text values.

Custom Development Lifecycle Phases for AI and Hardware

CWE 5.0 and Schema 8.0 also add support for custom product lifecycle phases across different domains through the Custom_Phases element.

Current supported domains include AI and Hardware, using enumerations such as AIPhaseEnumeration and HardwarePhaseEnumeration.

Custom_Phases can be used in:

• Potential_Mitigations
• Modes_Of_Introduction
• Detection_Methods

This provides a more flexible way to represent lifecycle-specific guidance for domains whose development processes do not always map neatly to traditional software phases.

Relationship Modeling Gets Stronger

Several important enhancements are also being made to relationships across the CWE List.

• Dimensions on relationships — Relationships defined in Related_Weaknesses for Weaknesses, Members for Views, and Relationships for Groupings can now include Dimensions sub-elements. These are intended to capture the dimensions along which two CWEs differ. For example, a ChildOf relationship might reflect that the child describes a more specific kind of resource.
• New relationship nature: Overlaps — A new relationship nature, Overlaps, has been added to represent the uncommon case in which multiple CWEs overlap each other. Although this does not introduce major syntax changes, consumers that process relationship semantics may need additional customization. As with PeerOf, the Overlaps relationship should be understood as symmetric.
• Relationship notes — Relationships can now include Note elements that provide additional explanation or context for the relationship itself. This capability is expected to be used infrequently, but it adds useful expressiveness where needed.

Multiple phases for introduction and detection

Any Mode_of_Introduction or Detection_Method can now have more than one Phase. This aligns those areas more closely with how Potential_Mitigations have been represented for years.

Additional Changes to Watch

Several other updates are included in Schema 8.0:

• Any Note type under the Notes element can now specify the associated CWE Version and ReleaseDate. This is expected to be especially useful for Maintenance and Research Gap notes.
• The targetNamespace will change to http://cwe.mitre.org/cwe-8
• Under Alternate_Terms, each Term can now include a Role sub-element to identify how the term is used, such as an abbreviation or alternate spelling. See AlternateTermRoleEnumeration.
• Under Applicable_Platforms, each sub-element type, including Language, Operating_System, and Architecture, now supports a Note

DRAFT SCHEMA FOR COMMUNITY REVIEW

To support early adoption and testing, the CWE Program has made both draft schema files and sample data available on the CWE website:

• Draft schema: cwe_schema_v8.0-DRAFT-1_xsd
• Test data XML: DRAFT-CWE-SCHEMA-8-CONTENT_xml

Consumers who validate, transform, or ingest CWE content should review these files as part of their migration planning.

LOOKING AHEAD

Schema 8.0 is a substantial step forward for the CWE List, enabling the program to represent technical nuance, dimensions, lifecycle context, and relationships with greater clarity and precision. For the CWE community, that means richer content and a stronger foundation for future growth.

Consumers are encouraged to review the draft schema and sample data early, test their integrations, and prepare for the transition as CWE 5.0 approaches.

Get the most up-to-date information on the CWE website.

Mission

By unifying previous domain-specific efforts, the XD-SIG aims to:

• Improve the usability and accessibility of the CWE corpus
• Promote accurate and precise use of CWE in vulnerability root cause mapping
• Promote broader industry adoption of CWE
• Support continuous improvement of CWE content and processes
• Enhance how weaknesses are defined, presented, and mapped across software, hardware, AI, and other domains

Membership & Community Engagement

Core Member Meetings

As active contributors to the XD-SIG, core members are expected to:

• Participate in monthly 1-hour core meetings
• Contribute to planning and coordination activities
• Engage in discussion between meetings
• Help advance group tasks and workshop topics

Community Workshops

Quarterly workshops will be held for the broader CWE community to share updates, demonstrate progress, and gather feedback on XD-SIG initiatives. Workshops are expected to average approximately two hours, depending on discussion topics.

Ways to Get Involved

Meeting dates and times are currently to be determined. If you would like to participate, please click here and follow the instructions.

In this episode, MITRE’s CWE™ and CVE™ Project Lead Alec Summers talks with CWE Technical Lead Steve Christey and CWE Top 25 Lead Connor Mullaly about the 2025 “CWE Top 25 Most Dangerous Software Weaknesses.”

Topics include what the CWE Top 25 is and why it matters for software security; how the list is calculated using prevalence and average severity; how the quality of mappings in CVE Records affects the accuracy and usefulness of the list; how CVE Numbering Authorities (CNAs) help build the list; common mapping problems, especially choosing overly broad or discouraged entries instead of more specific ones; changes in methodology for the 2025 list, especially moving away from normalizing everything into a smaller subset and instead reflecting what actually mapped in the full corpus; and practical advice for better root cause mapping, including using mapping notes, avoiding discouraged entries, and focusing on the underlying weakness rather than just the impact.

The podcast is available for free on the CWE Program Channel on YouTube. Please give our latest episode a listen and let us know what you think by commenting here on the CWE Blog on Medium, on the CWE page on LinkedIn, CWE on X, CWE on Mastodon, or CWE on Bluesky. We look forward to hearing from you!

• “Deep Dive Workshop into CVE-to-CWE Root Cause Mapping” by Connor Mullaly, Steve Christey Coley (The MITRE Corporation) (Monday, April 13, 13:30–17:30)
• “Boosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance” by David Starobinski, Sevval Simsek, Varsha Athreya (Boston University) (Tuesday, April 14, 14:35–15:05)
• “From Roadmap to Results: Measuring CWE Adoption to Enable Prevention” by Alec Summers, Steve Christey Coley (The MITRE Corporation) (Wednesday, April 15, 16:30–17:30)

We look forward to seeing you there!

The Top 25 highlights the most severe and prevalent weaknesses behind the 39,080 CVE™ Records in this year’s dataset. Uncovering the root causes of these vulnerabilities serves as a powerful guide for investments, policies, and practices to prevent these vulnerabilities from occurring in the first place. These weaknesses lead to serious vulnerabilities in software, and an attacker can often exploit them to take control of an affected system, steal data, or prevent applications from working.

What’s Changed

There are several notable shifts in ranked positions of weakness types from last year’s list, including weaknesses dropping away or making their first appearance in a CWE Top 25.

The 2025 Top 25’s #1 ranked weakness is CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross Site Scripting’), retaining the top position from last year while being the only CWE to not change in ranking. Notable shifts in rankings included CWE-862: Missing Authorization moving up 5 ranks to #4, CWE-20: Improper Input Validation moving down 6 ranks to #18, and CWE-77: Command Injection moving down 10 ranks to #23. Six new CWEs also appeared in the 2025 Top 25, most notably CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) at #11, CWE-352: Stack-based Buffer Overflow at #14, and CWE-122: Heap-based Buffer Overflow at #16. These new introductions are likely due to a change in methodology this year that allowed for better representation of more specific weaknesses.

Visit the Key Insights page on the CWE website for additional information.

Leveraging Real-World Data

The 2025 CWE Top 25 is the second year in a row where the CVE Numbering Authority (CNA) community directly contributed CWE mapping reviews within the dataset, leveraging their expert knowledge of the products and access to information that might not be present in the CVE Record. In general, CNAs are best positioned to provide accurate CWE mapping determinations compared to third-party analysts, as CNAs are the authority for vulnerability information within their CNA scope and those closest to the products themselves.

To create the 2025 list, the CWE Program leveraged public vulnerability data containing CWE mappings and Common Vulnerability Scoring System (CVSS) scores.

The 2025 CWE Top 25 leverages CVE Records for vulnerabilities published between June 1, 2024, and June 1, 2025. A scoring formula is used to calculate a ranked order of weaknesses by combining the frequency that a CWE is the root cause of a vulnerability with the average severity of each of those vulnerabilities as measured by CVSS.

For more information about how the list was created and the ranking methodology, visit the Methodology page on the CWE website.

The 2025 CWE Top 25

Also available now:

• 2025 CWE Top 10 KEV Weaknesses — Ranking actively exploited weaknesses by CISA’s KEV Catalog.
• 2025 “On the Cusp” Weaknesses List — 15 additional weaknesses that were “on the cusp” of being included in the 2025 CWE Top 25.

Check out the 2025 Top 25 Now

https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html

This new release delivers a major update to the original 2021 release. For the first time, the refreshed MIHW combines comprehensive weakness data with expert opinion from across the hardware security community, equipping organizations with actionable insights to tackle today’s most critical hardware risks.

Goals

The 2025 MIHW aims to drive awareness of critical hardware weaknesses and provide the cybersecurity community with practical guidance to prevent security issues at the source.

By combining advanced data analysis with expert consensus, the list helps organizations prioritize mitigations, strengthen design practices, and make informed decisions throughout the hardware lifecycle.

A Community Effort

The 2025 MIHW is the result of broad collaboration within the hardware security community. We extend our deepest gratitude to the 2025 MIHW Working Group whose dedication and hard work made the weakness data collection possible. We also thank the many respondents to the MIHW polls for sharing their expert insights, and all Hardware CWE SIG members for their ongoing support and contributions.

2025 CWE Most Important Hardware Weaknesses

Expert Insights: Weaknesses Beyond Data Trends

The weaknesses shown below were not included in the 2025 MIHW because they did not have sufficient weakness data to support their inclusion. However, they stand out as expert-driven selections. Each of these weaknesses received high scores from Subject Matter Experts, reflecting strong consensus among those with deep domain knowledge.

Suggested Use Cases

The 2025 MIHW serves as a practical resource for a wide range of stakeholders:

• Security Architects and Designers can use the list to prioritize and address key weaknesses
• Design Teams benefit by building review checklists around top weaknesses
• Security Researchers can focus their investigation and mitigation efforts
• Test Engineers are able to target critical weaknesses in their testing
• EDA Tool Vendors can enhance tool support for industry-prioritized issues
• Educators can align course material with major hardware weaknesses

Visit the 2025 MIHW Use Cases page on the CWE website for a more detailed look at each use case.

Learn More About the 2025 MIHW

Visit the Most Important Hardware Weaknesses page on the CWE website to view more details about the 2025 list, key insights, methodology, use cases, and more.

Videos of three CWE™-focused sessions from CVE/FIRST VulnCon 2025 — “Hard Problems in CWE, and What it Tells us about Hard Problems in the Industry” (presentation), “How Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities?” (presentation), and “Vulnerability Root Cause Mapping with CWE” (presentation) — are now available on the CWE Program Channel on YouTube. Or, watch below:

View these videos and more on the CWE Program Channel on YouTube.

In this episode, “Root Cause Mapping and the CWE Top 25,” CWE Program Lead Alec Summers talks with CWE Technical Lead Steve Christey and CWE Top 25 Lead Connor Mullaly, about Root Cause Mapping (RCM) and the CWE Top 25.

Topics include the value and history of the CWE Top 25 and an analysis of the most recent Top 25 list and which weaknesses moved up and down on the list; purpose and benefits of mapping the root causes of vulnerabilities identified in CVE Records to CWE weaknesses; methodology used for RCM of the 2024 CWE Top 25 to develop the list and how CVE Numbering Authorities (CNAs) were integral to the process; and, a discussion of follow-on Top 25 lists including the “2024 On the Cusp — Other Dangerous Software Weaknesses” and “2024 CWE Top 10 KEV Weaknesses” lists. In addition, tips for helping improve your RCM are also discussed, such as how best to leverage the CWE website for your research, using CWE List keyword search, where to find the vulnerability mapping pointers on all CWE entry pages and what the different indicators mean, the benefits of being a member of the Root Cause Mapping Working Group (RCM WG), and much more.

The podcast is available for free on the CWE Program Channel on YouTube. Please give our latest episode a listen and let us know what you think by commenting on the CWE page on LinkedIn, CWE on X, CWE on Mastodon, or CWE on Bluesky. We look forward to hearing from you!

Common Weakness Enumeration (CWE™) is the main focus of four talks at CVE/FIRST VulnCon 2025 being held at the McKimmon Center in Raleigh, North Carolina, USA, on April 7–10, 2025:

• “Vulnerability Root Cause Mapping with CWE: Challenges, Solutions, and Insights from Grounded LLM-based Analysis” by Alec Summers of the CVE Program and Chris Madden of Yahoo (Monday, April 7, 11:30–12:30)
• “Lessons Learned From Assigning CWE’s to Test Items for Security Assessments” by Yuichi Kikuchi, Takayuki Uchiyama of Panasonic PSIRT (Tuesday, April 8, 11:30–12:00)
• “How Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities?” by Alexander Bushkin and Jeremy West of Red Hat (Tuesday, April 8, 14:00–16:30)
• “Hard Problems in CWE, and What it Tells us about Hard Problems in the Industry (Virtual)” by Steve Christey Coley of the CWE Program (Thursday, April 10, 13:30–14:30)

We look forward to seeing you there!