    public function __construct($app = null)
    {
        if (is_object($app)) {
            $this->app = $app;
        } else {
            $this->app = mw();
        }


    }
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.