CWE and CVE are easy to confuse because they're both maintained by MITRE and both show up constantly in vulnerability tooling — but they answer different questions.
CVE: a specific, disclosed vulnerability
A CVE (Common Vulnerabilities and Exposures) identifier refers to one specific, publicly disclosed vulnerability in a specific product or version — "CVE-2024-XXXXX: a remote code execution vulnerability in [specific software] version X." CVEs are what your dependency scanner matches against when it tells you a library version is vulnerable.
CWE: a category of weakness
A CWE (Common Weakness Enumeration) identifier describes a general type of software weakness — "CWE-89: SQL Injection," or "CWE-79: Cross-Site Scripting." A CWE isn't tied to any specific product; it's a classification system for the underlying flaw pattern that many individual vulnerabilities share.
How they relate
Every CVE is typically tagged with one or more CWE identifiers, describing what kind of weakness the specific vulnerability represents. Thousands of individual CVEs across completely unrelated products can all map back to the same CWE — "SQL Injection" as a weakness class appears constantly across otherwise unrelated software.
Why this distinction matters practically
If you're deciding how to prevent an entire class of future vulnerabilities (not just patch one specific instance), CWE is the more useful reference — it describes the underlying pattern and general prevention guidance, independent of any one product. If you're checking whether your specific dependency version has a known, disclosed issue, CVE (and databases like the NVD) is what you need.
A common confusion in reports
Vulnerability scan reports sometimes list a CWE identifier without a corresponding CVE, which understandably confuses teams expecting "one finding = one specific disclosed vulnerability." A CWE-only finding usually means a scanner (often SAST) identified a pattern matching a known weakness class in your own code — not a disclosed vulnerability in a third-party dependency. Both are useful signals, but they mean different things and warrant different remediation approaches.