MITRE CWE API

MITRE CWE API

MITRE's Common Weakness Enumeration (CWE), at cwe.mitre.org, provides a keyless REST API and XML/CSV downloads for its catalogue of software and hardware weakness types — ids, descriptions, relationships and mitigations. A live weakness query confirms the service (CWE-79, cross-site scripting).

Coverage

Software and hardware weakness types — ids, descriptions, relationships and mitigations — confirmed live today via a weakness query (CWE-79) and a version query (ContentVersion 4.21, dated 2026-10-28). MITRE ATT&CK is a separate knowledge base of adversary tactics and techniques, distinct from this CWE weakness taxonomy. MITRE's CWE history page says: "the creation and the first release of the “Common Weakness Enumeration” List and associated classification taxonomy in 2006." Update frequency: Not stated.

Verdict

Keyless REST API (plus XML/CSV downloads) for MITRE's CWE catalogue of software and hardware weakness types — ids, descriptions, relationships and mitigations (confirmed live today via a weakness query, CWE-79, and a version query, ContentVersion 4.21). Licensed Custom: the CWE Terms of Use say: "CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use." and: "Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy." MITRE ATT&CK is a separate knowledge base of adversary tactics and techniques. Rate limits: Not stated. Signal Lab links only.