CVSS, CWE, and CVE, explained without the jargon
Open any vulnerability or pentest report and you will trip over three acronyms in the first paragraph: CVSS, CWE, and CVE. They look interchangeable and are not. Each answers a different question, and confusing them is how a finding gets mis-prioritized. Here is what each one is for, in plain terms.
CVE: a specific, named bug in the wild
A CVE (Common Vulnerabilities and Exposures) is a unique identifier for one specific, publicly disclosed vulnerability in a particular product, like a flaw in a named version of a library. The CVE program assigns these IDs (for example, CVE-2021-44228 for Log4Shell) so the whole industry can refer to the same issue unambiguously. If you see a CVE, it means: this exact, known bug exists in this exact software.
CWE: the category of mistake
A CWE (Common Weakness Enumeration) names the type of flaw, not a specific instance. MITRE's CWE list catalogs the underlying weakness classes: CWE-89 is SQL injection, CWE-79 is cross-site scripting, CWE-639 is the authorization bypass behind most IDORs. Where a CVE is one bug in the wild, a CWE is the kind of mistake that produces it. Reports use CWE so you can spot patterns: five findings sharing a CWE means one root cause, not five.
CVSS: how severe it is
CVSS (Common Vulnerability Scoring System), maintained by FIRST, is a 0 to 10 score for how severe a vulnerability is, factoring in how easily it can be exploited and how much damage it allows. The NVD publishes CVSS scores for known CVEs. Treat it as a useful comparison rather than gospel: a high base score on something an attacker cannot reach may matter less than a moderate score on your front door, which is why a good report weighs CVSS against real exploitability in your context.
CVE is which bug. CWE is what kind of bug. CVSS is how bad. Mix them up and you will fix the loud finding instead of the dangerous one.
How they fit together
A single finding can carry all three: a CVE identifying the specific bug, a CWE classifying the weakness behind it, and a CVSS score rating its severity. In a penetration test of your own application, you will often have CWE and CVSS without a CVE, because the flaw is in your code, not in a cataloged third-party product. That is normal and expected: a CVE is for known issues in shipped software, not for the novel weakness a tester just found in your app.
The number that should drive your triage is real exploitability, which is why Uvy proves the exploitable findings with a working exploit and scores severity on actual impact in your context, not just a raw CVSS number. We cover reading the rest of the report in how to read a penetration test report. See how it works.