CVE vs CWE: From Patch Fixes to Eradicating Root Causes

on YouTube ↗15m

" summary

Defines the difference and relationship between CWE (software weakness types) and CVE (specific vulnerabilities), explains why a CVE maps to one or more CWEs, and shows how to use that mapping in practice. Demonstrates with a live code example how a CWE (e.g., CWE-79 or CWE-89) appears in SAST/DAST tools and how to fix the root cause rather than just applying CVE patches. Gives guidance on using the CWE Top 25 during code reviews to move from reactive patching to durable prevention.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 1:02Log4Shell flaw discovery
3. 4:56CVE versus CWE
4. 8:29CWE security database
5. 10:20From CVE fixes to CWE eradication
6. 13:34CVE as symptom CWE as cause

" related talks

• 57mThe CWE Program: Current State and Road AheadAlec Summers · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 28mHow Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities?Alexander Bushkin, Jeremy West · CVE/FIRST VulnCon 2025
• 59mHard Problems in CWE, and What it Tells us about Hard Problems in the IndustrySteve Christey Coley · CVE/FIRST VulnCon 2025
• 56mCVE Is The Worst Vulnerability Framework (Except For All The Others)Ben Edwards, Sander Vinberg · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 57mVulnerability Root Cause Mapping with CWEAlec Summers, Chris Madden · CVE/FIRST VulnCon 2025
• 01h 01mFrom Roadmap to Results: Measuring CWE Adoption to Enable PreventionAlec Summers, Steve Christey Coley · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You NeededJulia Turkevich, Rina Rakipi · CVE/FIRST VulnCon 2025
• 43mSecurity Vulnerabilities Decomposition: Another way to look at VulnerabilitiesKaty Anton · NDC Oslo 2019