https://artur-rios.github.io/personal-lab/security/Recent content in Security on Artur Rios LabHugoen-usTue, 20 Oct 2026 23:30:00 +0000https://artur-rios.github.io/personal-lab/security/cve-and-cwe/Tue, 20 Oct 2026 23:30:00 +0000https://artur-rios.github.io/personal-lab/security/cve-and-cwe/<p>A dependency scanner fails your build with &ldquo;CVE-2021-44228, critical&rdquo;. A static analysis tool flags a line of code as &ldquo;CWE-89&rdquo;. A vendor&rsquo;s release notes list a dozen CVE numbers fixed in the latest patch, and a security questionnaire asks how you prevent &ldquo;the CWE Top 25&rdquo;. The two acronyms look alike, both are run by the same organisation and both turn up in the same tools, but they answer different questions. <strong>CVE</strong> answers <em>which vulnerability is this?</em>: it gives one specific, publicly known flaw in one product a name everyone can use. <strong>CWE</strong> answers <em>what kind of mistake is this?</em>: it names a type of weakness that can occur in any product, and that may cause many vulnerabilities over the years.</p>