The Shape Of The Bug Screensaver
The The Shape Of The Bug screensaver shows weaknesses from MITRE’s CWE catalogue, key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the The Shape Of The Bug screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
Weaknesses from MITRE’s CWE catalogue, key-less. A CVE is one bug in one product; a CWE is the pattern behind it. A few dozen account for most of everything, and they are the same few dozen as in the 1990s.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
CWE, the catalogue of mistakes
CWE stands for Common Weakness Enumeration, a community-developed list of software and hardware weakness types that can lead to exploitable vulnerabilities. It is maintained by MITRE and sponsored by the US Cybersecurity and Infrastructure Security Agency (CISA). Where a CVE identifies one flaw in one product, a CWE describes the kind of mistake behind it, and one CWE entry can be the root cause of many CVE records.
Entries sit at different levels of abstraction. A Pillar is the most abstract, a Class is still very abstract and generally independent of any language or technology, a Base is detailed enough to suggest specific detection and prevention methods, and a Variant is very specific, usually tied to one language or technology. Each entry has a numeric ID and a description.
MITRE also maintains the annual CWE Top 25 Most Dangerous Software Weaknesses, which ranks weaknesses found in a year's CVE records using how often they appear and their average CVSS score. A weakness appearing on screen is a reference entry, not a report of any bug in any particular product.
A worked example
Weaknesses from MITRE’s CWE catalogue, key-less. A CVE is one bug in one product; a CWE is the pattern behind it. A few dozen account for most of everything, and they are the same few dozen as in the 1990s.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- What is the difference between a CVE and a CWE?
- A CVE identifies one specific vulnerability in a particular product, whereas a CWE names the general kind of weakness it is an instance of.
- Does a weakness on screen mean something is currently being exploited?
- No. A CWE entry is a reference definition of a type of error, not an alert about an active attack.