CWE MITRE Scraper

CWE MITRE Scraper

Scrape the complete CWE MITRE weakness taxonomy, from a single CWE to every entry, with full descriptions, relationships, and mitigations. Export structured software weakness data to JSON, CSV, Excel, or XML for security analysis, compliance, and threat modeling.

The CWE MITRE database is the industry standard for classifying software and hardware weaknesses, but browsing it manually or parsing raw XML dumps is slow and inconsistent. This actor reads the live CWE website directly, returning each weakness, category, or view as a clean, flat record. No API key, no XML parsing, and no rate-limit headaches.

Who uses it	What they scrape CWE MITRE for
Application security engineers	Building a threat model with a complete list of relevant software weaknesses.
Compliance analysts	Mapping regulatory requirements to specific CWE entries for audit evidence.
Penetration testers	Pulling the latest detection methods and common consequences for a weakness before testing.
Security tool vendors	Populating a product's rule database with the full CWE taxonomy and its relationships.

What it does

This Actor collects CWE entries by individual ID, batch of IDs, category, or view, and returns each weakness as a structured row with its description, extended description, relationships, mitigations, and detection methods.

• 🎯 Single CWE lookup: Fetch one weakness by its numeric ID, like 79 for Cross-Site Scripting or 89 for SQL Injection.
• 📚 Batch CWE lookup: Pass an array of CWE IDs and retrieve all of them in one run.
• 🗂️ Full taxonomy dump: Scrape every CWE entry in the database, filtered by a substring on the weakness name.
• 📁 Category mode: Pull all weaknesses that belong to a CWE Category, such as Software Development (699).
• 🏆 View mode: Extract the members of a curated CWE View, like the CWE Top 25 Most Dangerous Software Weaknesses.
• 🔍 Name filter: In 'all' mode, apply a case-insensitive substring filter to collect only weaknesses matching a term like 'Injection' or 'Memory Corruption'.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with CWE MITRE data

🛡️ Populate a threat modeling tool.

A security architect runs the actor in 'all' mode with the filter 'Authentication' to import every related CWE into a threat modeling platform.

📋 Generate compliance mapping evidence.

A compliance analyst pulls the full CWE Top 25 view to cross-reference each entry against PCI DSS requirements for a quarterly audit.

🔬 Research a specific weakness class.

A penetration tester fetches CWE-787 and all its child weaknesses to understand every variant of out-of-bounds write before a memory corruption assessment.

🏗️ Seed a security product's knowledge base.

A vendor runs the actor weekly in 'all' mode to keep their SAST tool's rule descriptions and mitigation advice in sync with the official CWE MITRE taxonomy.

Why choose this scraper

	What you get
Structured output	Every CWE entry is flattened into a consistent row with description, relationships, mitigations, and detection methods.
Live data	Data is scraped directly from the official CWE MITRE website, reflecting the latest updates.
No XML parsing	You get clean JSON, CSV, Excel, or XML output without handling the raw CWE XML feed.
Flexible scoping	Target a single weakness, a hand-picked batch, an entire category, or a curated view like the Top 25.

How it compares

No other Store actor targets CWE MITRE the same way, so the honest comparison is with the alternatives teams actually weigh.

	CWE MITRE Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When CWE MITRE changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor by selecting a mode and providing a CWE ID, a batch of IDs, a category ID, or a view ID. In 'all' mode, a free-text name filter runs as each entry is read so only matching weaknesses reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
  "mode": "single",
  "cweId": "79",
  "maxItems": 10
}

A larger pull:

{
  "mode": "single",
  "cweId": "79",
  "maxItems": 200
}

Pricing

Pay-per-result: $0.033 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$3.30
1,000 results	$33.00
10,000 results	$330.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the CWE MITRE Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to CWE MITRE through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/cwe-mitre-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results for my CWE ID?

Verify that the CWE ID is a valid numeric identifier on the CWE MITRE website. Some IDs may have been deprecated or replaced. Check the official site to confirm the ID is still active.

The actor is running but returning fewer results than expected.

Check the 'Maximum entries' setting. If it is set lower than the number of available weaknesses, the actor will stop early. Increase this value to collect more entries.

My name filter in 'all' mode is not matching any weaknesses.

The filter is a case-insensitive substring match on the CWE name. Try a shorter or more general term. For example, use 'Injection' instead of 'SQL Injection' to catch all injection types.

The actor times out when scraping the full CWE list.

The full CWE taxonomy contains over 900 entries. Increase the run timeout in your Apify actor settings, or use the 'Maximum entries' field to limit the run to a smaller batch.

I am getting an error for a View or Category ID.

Ensure you are using the correct numeric ID for the view or category. These are different from CWE weakness IDs. Check the CWE MITRE website for the specific view or category identifier you need.

FAQ

Question	Answer
What is the difference between a CWE Category and a CWE View?	A Category is a thematic grouping of weaknesses that share a common characteristic, like 'Software Development'. A View is a curated subset of the taxonomy for a specific purpose, like the CWE Top 25 Most Dangerous Software Weaknesses.
Can I scrape multiple specific CWE IDs at once?	Yes. Use the 'single' mode and provide an array of numeric CWE IDs in the 'CWE IDs (batch lookup)' field. The actor will fetch each one in sequence.
Does this actor include CWE relationships like 'ChildOf' or 'CanPrecede'?	Yes. The output includes related weaknesses, the nature of each relationship, and the target CWE ID and name.
Are mitigation and detection methods included in the output?	Yes. Each record contains the potential mitigations, detection methods, and common consequences as listed on the official CWE MITRE page.
How do I get only the CWE Top 25?	Select 'CWE View' mode and enter the view ID for the Top 25, such as 1387 for the 2024 list. The actor will return every weakness in that view.
Can I filter the full CWE list by a keyword?	Yes. In 'all' mode, use the 'Category Filter' field to provide a substring like 'SQL Injection' or 'Buffer Overflow'. Only weaknesses whose names contain that string will be collected.
What output formats are supported?	The actor can export your dataset to JSON, CSV, Excel, or XML, depending on how you configure the Apify dataset export.
Is this using the official CWE API?	No. This actor scrapes the public CWE MITRE website directly, so you do not need an API key or to handle the raw XML data feed.
How often is the CWE data updated?	The actor reads the live website on each run, so you always get the latest published version of every CWE entry.
Can I scrape a CWE Category like 'Software Development'?	Yes. Select 'CWE Category' mode and enter the category ID, such as 699. The actor will return all weaknesses that are members of that category.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by The MITRE Corporation. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.