I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities relate to the design phase and static code analysis." As the article is more for software engineers and developers, I am looking for an accurate, clear, and concise explanation that speaks to that audience.
Briefly: CVEs are for "known knowns" or specific vulnerabilities. CWEs are for "unknown knowns" or vulnerability types. Dynamic scanners are looking for instances of already-identified vulnerabilities. Static scanners do that, too, but one of their main advantages is that they are also looking for not-yet-identified new vulnerabilities.
An obvious example is that if you are testing code that the world has never encountered before, how could there already be a registered CVE about it? You can, however, talk about the type of problem, and that is what a CWE does.
As part of building the CVE, MITRE developed in 2005 a preliminary classification and categorization of vulnerabilities, attacks, faults, and other concepts to generalize the CVE into common software weaknesses. However, while sufficient for CVE, those groupings were too rough to be used to identify and categorize the functionality offered by the code security assessment tool makers. The CWE List was created to better address those additional needs. CVE are akin to an inventory of traffic accidents while the CWE are analogous to the conditions (e.g. highway architecture, bridge and road design, traffic signage, driver practices, enforcement procedures) that lead to accidents. Given the large number of CVE and the process for reporting them, CVE references to architectural and design causes are intermittent and largely unverified. When generating findings from code scans, static code analysis tools can draw upon the CWE for weakness descriptions and mitigation recommendations; identifying the relevant CVE would be difficult given their specificity and their disconnection from the code that generated them.