The European Union Vulnerability Database (EUVD) has been publicly available since 13 May 2025. Most IT teams opened it once back then, compared it against the NVD, and went back to the feeds they already had. Over the past year its position in the European vulnerability pipeline has shifted enough to warrant a second look — and to be clear about what you actually get from it today.
Why now
Since 20 November 2025, ENISA has been a Root in the CVE Program. It no longer merely assigns its own identifiers; it recruits, trains and supervises other organisations authorised to assign CVEs (CNAs). On 6 August 2026 it announced that the NATO Communications and Information Agency and AISLE had joined under its Root, bringing the total to 20 CNAs — 12 onboarded directly and 8 transferred from the original MITRE Root.
The second shift arrives on 11 September 2026, when the Cyber Resilience Act starts requiring manufacturers to report actively exploited vulnerabilities to ENISA. European vulnerability data stops being purely derivative of US sources.
What the database holds
The EUVD exists under Article 12 of the NIS2 Directive and aggregates records from the CVE Program, vendor advisories and national CSIRT reports. Each record carries its own identifier in the form EUVD-2026-34095, with an alias field linking it back to the CVE and, where relevant, to a GitHub advisory.
The useful part is what comes attached: a CVSS 4.0 rating, an EPSS score estimating the likelihood of exploitation, and a structured list of affected vendors, products and version ranges. A concrete example: GLPI's CVE-2026-42318, which lets a user with planning access delete arbitrary objects (CVSS 4.0 = 7.0), appears as EUVD-2026-34095, including the fact that versions 10.0.25 and 11.0.7 carry the fix.
A free API with no registration
The practical advantage over the web interface is a public REST API at euvdservices.enisa.europa.eu — no authentication, no API key. The endpoints worth knowing:
/api/search— search by text, vendor or product/api/enisaid?id=EUVD-2026-34095— a single record in full/api/criticalvulnerabilitiesand/api/exploitedvulnerabilities— overview lists/api/kev/dump— the full known-exploited list
For an organisation whose asset inventory is in order, this is the cheapest way to connect the list of deployed software to a continuously updated vulnerability source.
Where it still falls short
As of late August 2026, the known-exploited list held 1,692 records. Of those, 44 carry the European source tag, and only 6 are absent from the US CISA KEV catalogue. The European list is still largely a mirror rather than a replacement — if you track CISA KEV today, there is no reason to switch it off.
The EUVD is also a data source, not a vulnerability management tool. It will not tell you which of those thousands of records touch your estate. That remains the job of an asset inventory with normalised vendor, product and version names.
How it fits Slovak decree 227/2025
Vulnerability assessment is mandatory under decree 227/2025, and an audit tests it against documentation, not against a claim that you follow security advisories. Three things need to be evidenced: which source your vulnerability information comes from, how often you check it, and the remediation deadlines you apply by severity. The EUVD works as one of those named sources — EU-operated, free of licensing terms, and machine readable.
For entities registered before 1 January 2025, the transition period closes on 31 December 2026. That leaves four months to get this part of the documentation in place.