From Dependence to EUVD: Why Europe Must Rely on Its Own Vulnerability Databases

In April 2025, the world of IT security came close to chaos: funding for the CVE program by the US government was not extended as expected. Only at the last minute did the US agency CISA step in and prevent a standstill. The uncertainty remains. This event once again made clear how fragile global security infrastructure is when it rests on a single government-funded system.

CVE crisis as a wake-up call for Europe

The CVE program, operated by MITRE on behalf of the US government, has for decades been the central data source for identifying IT vulnerabilities. But when it became known in spring 2025 that this very system might be left without a budget, the risks of a single point of failure became obvious. IT experts worldwide warned that without CVE IDs, security processes, patch management, and automated vulnerability analysis would collapse.

Dependence on a US-based system whose continued existence is politically uncertain shows that Europe must go its own way. This is exactly where the European Union Vulnerability Database (EUVD) comes in.

EUVD: sovereignty through our own vulnerability intelligence

The EUVD was announced in June 2024 as part of the NIS2 implementation (https://digital-strategy.ec.europa.eu/en/news/eu-launches-european-vulnerability-database-boost-its-digital-security) and officially entered full operation in May 2025 (https://euvd.enisa.europa.eu/). Its aim: to create a central European platform for IT vulnerability information that is operated independently of third countries. It provides:

• Its own EUVD IDs, supplemented by CVE references
• Up-to-date information on affected products, exploit status, CVSS scores, and patch availability
• Data aggregation from CVE, CERTs, vendor advisories, and CISA lists
• Automated entries that are updated in near real time

In doing so, the EUVD does not replace the CVE system, but complements it in a useful way: it offers redundancy, regional relevance, and greater resilience.

Why the EUVD must be supported now

The CVE funding crisis has shown how quickly a security system used around the world can be thrown off balance. For Europe, this produces a clear call to action:

• Expand investment in the EUVD in order to secure long-term independence
• Accelerate integration into European legislation (for example the Cyber Resilience Act)
• Raise awareness among companies so that they also align their systems with EUVD data

Only with a strong EUVD can Europe ensure that critical security information remains available even when the CVE system is temporarily shaken. A trustworthy vulnerability database carried by European interests is no longer an alternative – it is a strategic necessity.

Conclusion: EUVD is more than a project – it is a security promise

Europe can and should learn the lessons of the CVE crisis. With the EUVD, a functioning, transparent, and independent infrastructure is ready that must be strengthened and developed further. It is not only an instrument of technical security, but a symbol of digital sovereignty. Whoever invests in the EUVD today invests in the resilience of Europe’s digital future.

This text was written as part of our work on the European research project CRACoWI (Cyber Resilience Act Compliance Wizard). The aim of the project is to support companies – especially SMEs – with digital tools in implementing the EU Cyber Resilience Act. It quickly became clear that no sound security assessment is possible without reliable information on current vulnerabilities. This is exactly where the European Union Vulnerability Database (EUVD) comes in. As a European-operated, independent vulnerability database, it provides the foundation for many of the security-relevant processes that CRACoWI aims to automate and simplify. Our examination of the EUVD shows how important such infrastructures are for an independent, resilient cybersecurity strategy in Europe – and how strongly technical tools such as CRACoWI benefit from them.