We treat the EUVD as a complementary (not substituting) data source, in line with ENISA's own positioning. It is not yet part of the DevGuard vulnerability database, so integration needs to be implemented. Based on prior communication between ENISA and our team as DevGuard maintainers, the integration is planned in two stages.
Stage 1 — Identifier sync & KEV catalog
- Sync EUVD identifiers so CVE and EUVD IDs are held as aliases in the vulnerability DB.
- Display identifiers in the frontend, linking out to the EUVD for further info.
- Expose them via the DevGuard API and in VEX/CSAF files.
- Enrichment is driven by a CVE→EUVD mapping CSV provided by ENISA.
- Analogous to the existing CISA-KEV enrichment, also sync the EUVD Known-Exploited-Vulnerabilities catalog (available as a JSON bulk download).
Stage 2 — EU CSIRT network assessments - TBD
- The core value-add is the qualified assessments from the EU CSIRT network. These are part of the EUVD but not retrievable in aggregate via its API.
- We therefore connect directly to the CSAF endpoints of the national CSIRTs (e.g. BSI in Germany, NCSC-NL in the Netherlands).
- The standardized CSAF documents feed into the enrichment of CVE descriptions within the existing cves table.
We treat the EUVD as a complementary (not substituting) data source, in line with ENISA's own positioning. It is not yet part of the DevGuard vulnerability database, so integration needs to be implemented. Based on prior communication between ENISA and our team as DevGuard maintainers, the integration is planned in two stages.
Stage 1 — Identifier sync & KEV catalog
Stage 2 — EU CSIRT network assessments - TBD