A CySA+ analyst reviews a vulnerability assessment report that lists 47 distinct findings across a fleet of internally developed web applications. Management asks the analyst to summarize the underlying software weaknesses so the development team can address them systematically rather than patching each finding individually. Which classification framework should the analyst reference to group the findings by their common root-cause weakness type?