The case for fixing CWE weakness patterns instead of patching one bug at a time