European Vulnerability Database (EUVD): NIS 2 Guide

The European Vulnerability Database (EUVD) is the official European Union repository for tracking, managing, and disclosing cybersecurity vulnerabilities in information and communication technology (ICT) products and services. Established under Article 12 of Directive (EU) 2022/2555 (the NIS 2 Directive), the platform is developed, hosted, and maintained by the European Union Agency for Cybersecurity (ENISA). EUVD provides European organizations, critical infrastructure operators, security researchers, and national Computer Security Incident Response Teams (CSIRTs) with curated, machine-readable vulnerability intelligence, severity ratings, and remediation advisories.

What Is the European Vulnerability Database (EUVD)?

The European Vulnerability Database operates as an authoritative public repository designed to enhance European digital sovereignty and operational resilience against software supply chain threats. In modern cybersecurity practice, organizations across Europe have historically relied on third-country vulnerability repositories, most notably the U.S. National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology (NIST). Recital 63 of the NIS 2 Directive specifically observed that preexisting vulnerability registries were hosted outside the European Union, creating systemic dependencies in the event of foreign operational disruptions or procedural backlogs.

EUVD addresses this structural vulnerability by establishing an independent, transparent platform operated under European governance. The platform supports Coordinated Vulnerability Disclosure (CVD) frameworks, serving as a structured bridge between vulnerability discoverers, software vendors, and infrastructure operators. Under Article 12 of NIS 2, Member States designate national CSIRTs as coordinators to act as trusted intermediaries, negotiating disclosure timelines, managing multi-party vulnerabilities, and safeguarding researcher anonymity. Disclosed vulnerabilities are then cataloged within EUVD with standardized severity metrics and actionable patching instructions.

Who Runs It and What It Covers

EUVD is governed and operated by ENISA in consultation with the NIS 2 Cooperation Group and in operational alignment with the CSIRTs Network. Article 12(2) of Directive (EU) 2022/2555 mandates ENISA to establish appropriate information systems, technical standards, and governance policies to ensure the integrity and accessibility of the repository for all public and private stakeholders.

The scope of EUVD encompasses vulnerabilities affecting hardware, commercial software, firmware, and cloud services deployed across European critical sectors. Coverage features include:

• EUVD Unique Identifiers: Each registered entry is assigned a persistent European record number using the format EUVD-YYYY-NNNNN alongside an underlying 128-bit UUID (enisaUuid).
• CVE Cross-Referencing: Entries map directly to Common Vulnerabilities and Exposures (CVE) numbers under the aliases schema, ensuring bidirectional interoperability with global tracking mechanisms.
• Standardized Severity Scoring: Records publish Common Vulnerability Scoring System (CVSS) base scores, score versions (such as CVSS v3.1), and complete vector strings that break down attack complexity, privileges required, and impact metrics.
• Predictive Exploitation Scoring: The database integrates the Exploit Prediction Scoring System (EPSS) to model the probability of real-world weaponization within security operations centers.
• Exploited Vulnerability Tracking: EUVD maintains a curated feed of Known Exploited Vulnerabilities (KEV), cross-referencing threat alerts from international partners such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA KEV).
• Remediation Guidance: By legislative mandate, each record provides verified vendor patch links, configuration workarounds, or official mitigation advice issued by national CSIRTs.

How to Search or Use It

Security practitioners, systems engineers, and compliance administrators can interact with EUVD through its public web portal or programmatically via high-throughput REST APIs. The platform exposes structured JSON endpoints hosted at https://euvdservices.enisa.europa.eu/api that require no paid license or proprietary gateway.

1. Access the Web Portal: Navigate to the web application at https://euvd.enisa.europa.eu/ to access preconfigured analytical dashboards, including dedicated views for newly published flaws and active exploits.
2. Execute Targeted Text Searches: Utilize the search interface or the query parameter /search?text= to locate specific software products, affected library names, or vendor assigners.
3. Filter by CVSS Severity Range: Isolate critical vulnerabilities requiring mandatory triage by querying score brackets, such as /search?fromScore=9&toScore=10, targeting high-impact flaws.
4. Monitor Known Exploited Vulnerabilities: Filter for threats currently exploited in the wild using /search?exploited=true or automate threat intelligence feeds by downloading the machine-readable dataset from /api/kev/dump.
5. Lookup Records by Record ID: Retrieve comprehensive technical dossiers by calling /api/enisaid?id=<IDENTIFIER>, which resolves both EUVD format keys (e.g., EUVD-2026-118541) and standard CVE aliases.
6. Ingest Automated Streaming Feeds: Integrate continuous vulnerability feeds into vulnerability scanners or SIEM tools by periodically polling /api/lastvulnerabilities and /api/criticalvulnerabilities for newly ingested records.

Strengths and Limits

The establishment of EUVD introduces tangible advantages for European research security and digital infrastructure, alongside operational limits inherent to an evolving repository framework.

Key Strengths

• Regulatory Harmonization: Directly aligns vulnerability management with NIS 2 compliance mandates, European Cyber Resilience Act (CRA) standards, and national reporting obligations.
• Legal CVD Protection: Supports coordinated vulnerability disclosure frameworks where national CSIRTs provide legal clarity and anonymous submission pathways for ethical security researchers.
• Open Machine-Readable Architecture: REST APIs provide standardized JSON outputs with explicit vendor mappings, CVSS vector strings, and EPSS metrics without gating access behind commercial subscriptions.
• Public Sector Transparency: Ensures public access to mitigation guidance even when commercial vendors delay public patch availability, empowering network defenders.

Operational Limits

• Repository Maturity: Compared to historical databases operating since the 1990s, EUVD is expanding its historical corpus and legacy software coverage.
• Multi-Jurisdiction Ingestion: Ingestion velocity relies partially on coordinated voluntary reporting from 27 individual EU Member State CSIRTs and diverse national authorities.
• Cross-Border Operational Overlap: Security teams operating multinational environments must harmonize EUVD data products with external frameworks, including institutional protocols such as CMMC compliance for research institutions and regulatory information security baselines like ISO 27001 for research data security. Research teams should also incorporate these repository feeds into mandatory research security training curricula.

Alternatives

While EUVD represents the authoritative repository for the European Union, researchers and systems administrators frequently leverage complementary public and open-source vulnerability databases depending on operational scope and licensing requirements.

Platform / Repository	Governance and Host	Primary Identifier	Primary Focus and Scope	API Format
EUVD	ENISA (European Union)	EUVD-YYYY-NNNNN	European ICT products, NIS 2 entities, CVD reports, and CSIRT advisories	Open REST API (JSON)
NVD	NIST (United States)	CVE-YYYY-NNNNN	Global software analysis, automated CPE mapping, and CVSS baseline scoring	REST API (JSON)
CVE List	CVE Program / MITRE	CVE-YYYY-NNNNN	Global identifier assignment registry maintained by CVE Numbering Authorities	JSON 5.0 Repository
OSV	OpenSSF / Google	OSV / GHSA / CVE	Open-source package ecosystems, git commit ranges, and software supply chains	Open REST API (JSON)

In academic research workflows, persistent dataset citations and vulnerability references can also be tracked using identifiers such as a Crossref DOI to ensure reproducibility across technical publications and security benchmarks.

Frequently Asked Questions

Is EUVD intended to replace the U.S. National Vulnerability Database?

No. EUVD is designed to provide European strategic autonomy, operational resilience, and direct alignment with EU directives such as NIS 2, rather than completely replacing international repositories. ENISA actively cooperates with international operators of the CVE system and third-country registries to avoid duplicate effort and maintain interoperability.

Who is authorized to report vulnerabilities to EUVD?

Under Article 12 of the NIS 2 Directive, any entity—regardless of whether it falls within the mandatory scope of NIS 2—along with software suppliers, independent researchers, and competent authorities, may voluntarily register and disclose publicly known vulnerabilities through designated national CSIRTs.

How does EUVD ensure researcher anonymity during vulnerability reporting?

Article 12(1) of Directive (EU) 2022/2555 legally requires Member States to enable anonymous reporting of vulnerabilities to designated coordinator CSIRTs. The coordinator CSIRT manages communication with the affected vendor and maintains diligent follow-up without disclosing the identity of the finder without explicit consent.

What identifier format does EUVD use?

EUVD records are assigned an alphanumeric identifier following the format EUVD-YYYY-NNNNN (for example, EUVD-2026-118541) and an internal UUID. When a vulnerability corresponds to an existing Common Vulnerabilities and Exposures record, the CVE identifier is cataloged under the entry’s aliases.

Are EUVD API endpoints free to use for academic and open-source research?

Yes. The REST APIs hosted at https://euvdservices.enisa.europa.eu/api are publicly accessible without subscription fees, API keys, or proprietary usage agreements, allowing automated security pipelines and academic researchers to query endpoints such as /api/lastvulnerabilities and /api/kev/dump.

Sources

• European Parliament and Council of the European Union. Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Recitals 62-63, Article 12. EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555 (read 2026-11-08).
• European Union Agency for Cybersecurity (ENISA). European Vulnerability Database (EUVD) Portal. https://euvd.enisa.europa.eu/ (read 2026-11-08).
• European Union Agency for Cybersecurity (ENISA). EUVD Services REST API (/api/lastvulnerabilities, /api/criticalvulnerabilities, /api/kev/dump). https://euvdservices.enisa.europa.eu/api (read 2026-11-08).