What Is the ENISA European Vulnerability Database (EUVD)? A Practical Guide

The European Union now has its own vulnerability database. The ENISA European Vulnerability Database (EUVD), provided for by NIS2 Article 12, has been operational since May 2025 as Europe’s source for vulnerability intelligence. For organizations operating in the EU, understanding the EUVD is worth your time: it is one more public source on what is being exploited.

This guide explains what the EUVD is, what data it provides, how it compares to existing databases, and how to use it in practice.

What is the EUVD?

The European Vulnerability Database is maintained by the European Union Agency for Cybersecurity (ENISA) under the mandate of the NIS2 Directive. Specifically, NIS2 Article 12 requires ENISA to establish and maintain a European vulnerability database to support EU member states and organizations with vulnerability intelligence.

The EUVD provides:

• Exploited vulnerability tracking, Identifies vulnerabilities actively exploited in the wild, similar to CISA’s KEV catalog but from a European perspective
• CVSS severity scores, Provides its own CVSS assessments, useful as a fallback when NVD enrichment is delayed
• EU-contextualized advisories, Vulnerability information with relevance to European infrastructure and regulations
• API access, RESTful API for automated integration into vulnerability management tools

The EUVD is accessible at euvd.enisa.europa.eu.

Why does the EU need its own vulnerability database?

Three primary reasons drove the creation of the EUVD:

1. Reducing dependency on US infrastructure

The global vulnerability management ecosystem has historically depended on two US-operated resources: the NIST National Vulnerability Database (NVD) and MITRE’s CVE program. Both have faced operational challenges:

• NVD backlog crisis (2024-2026): NIST significantly reduced its CVE enrichment rate, leaving ~44% of new CVEs without CVSS scores or CPE matching
• CVE program funding uncertainty: The MITRE-operated CVE program has faced documented funding concerns
• US Cloud Act exposure: Organizations relying solely on US-hosted vulnerability data face potential data sovereignty issues

For EU organizations subject to NIS2, depending exclusively on US-operated databases creates a single point of failure in their vulnerability management process.

2. NIS2 legal basis

NIS2 Article 12(2) provides for a European vulnerability database that ENISA develops and maintains. Access is open to all stakeholders, whether or not they fall within the scope of the Directive.

3. European context

The EUVD can provide vulnerability intelligence contextualized for European infrastructure, regulatory requirements, and threat landscapes. As the EU cybersecurity ecosystem matures, having a European perspective on which vulnerabilities are most relevant to EU organizations becomes increasingly valuable.

EUVD vs. NVD vs. CISA KEV: How they compare

Key takeaway: These databases are complementary, not competing. The most resilient vulnerability management approach uses all three.

How SentriKat integrates the EUVD

SentriKat uses the EUVD in two ways:

Exploited vulnerability tracking

SentriKat syncs EUVD exploited vulnerabilities alongside CISA KEV entries daily. This provides dual-continent coverage: vulnerabilities flagged by both US (CISA) and EU (ENISA) authorities are matched against your software inventory.

When a vulnerability appears in both CISA KEV and EUVD exploited lists, SentriKat shows both designations, giving you full visibility into which authorities consider a vulnerability actively exploited.

CVSS score fallback chain

SentriKat’s multi-source CVSS enrichment uses the EUVD as a tertiary scoring source:

1. NVD (primary), Industry standard, most comprehensive
2. CVE.org + CISA Vulnrichment (secondary), CNA-provided and ADP-enriched scores
3. ENISA EUVD (tertiary), European scores, critical when NVD enrichment is delayed

Every CVE score includes a cvss_source provenance tag so you always know where your severity data comes from. If the NVD hasn’t scored a CVE yet, SentriKat automatically falls back to CVE.org, then EUVD, ensuring you’re never blind to severity just because one database is behind.

Practical implications for EU organizations

If your organization falls under NIS2 as an essential or important entity:

1. You need structured vulnerability handling, Article 21(2)(e) requires it. The European database is one more source you can read; the Directive does not oblige entities to use it.

2. Data sovereignty matters, Running your vulnerability management platform on-premises (not in a US cloud) with European data sources strengthens your compliance posture.

3. Multi-source intelligence is resilience, No single database is perfectly reliable. By combining CISA KEV, NVD, CVE.org, and EUVD, you eliminate single points of failure in your vulnerability intelligence pipeline.

4. Audit trail is required, NIS2 demands demonstrable compliance. SentriKat’s per-CVE source attribution (cvss_source: nvd, cvss_source: euvd) provides the provenance trail auditors expect.

Getting started

SentriKat integrates ENISA EUVD out of the box, no configuration required. EUVD sync runs automatically alongside CISA KEV and EPSS updates.

To learn more about SentriKat’s multi-source vulnerability intelligence architecture, read our technical deep-dive: Why We Stopped Trusting a Single Vulnerability Database.

For NIS2 compliance specifically, see our guide: NIS2 Vulnerability Management: What European SMBs Need to Know.