EUVD vs NVD: cross-reference EUVD IDs and CVEs
How the EU Vulnerability Database (ENISA) compares with NVD (NIST), how to find the CVE for an EUVD ID, what to do when there is no CVE mapping, and how to cross-reference EUVD and CVE records in Claude or ChatGPT.
Add the CVE brain to your AI assistant
The EU Vulnerability Database (EUVD) and the National Vulnerability Database (NVD) both describe software vulnerabilities. NVD is run by NIST in the US and is keyed by CVE IDs. The EUVD is run by ENISA for the EU and gives each record its own EUVD ID. Most of the time you need to go from one to the other: an EU advisory cites an EUVD ID and your scanner speaks CVE.
Short answer: an EUVD ID (EUVD-YYYY-NNNNN) is ENISA's identifier for a record in the European vulnerability database. A CVE ID (CVE-YYYY-NNNN) is the global identifier from the CVE Program, which NVD enriches. When an EUVD record has a CVE, it lists it in its aliases, so the EUVD to CVE lookup is reading that alias. A record that lists no CVE has no CVE to find.
How to find the CVE for an EUVD ID
- Copy the full EUVD ID from the advisory or ticket. It has the form EUVD-YYYY-NNNNN.
- Open the record in the EUVD (euvd.enisa.europa.eu), or ask your AI assistant to look it up with the KBrain CVE brain.
- Read the record's aliases, the other identifiers for the same vulnerability. The CVE ID is listed there when one exists.
- Look up that CVE for the NVD detail: CVSS vector, weakness (CWE), affected products and references. Then check CISA KEV and EPSS for exploitation.
Worked example: EUVD-2024-31989
Asked for EUVD-2024-31989, the CVE brain resolves it to CVE-2024-3400, the command injection in the GlobalProtect feature of Palo Alto Networks PAN-OS. The same answer carries both views. NVD rates it CVSS 3.1 10.0 (critical) with weakness CWE-20. The EUVD record has a base score of 10 and flags it as exploited since 12 April 2024. CISA added it to the KEV catalog on the same day and marks ransomware use as known. These values are as returned on 2 November 2026; scores and statuses can change.
When there is no CVE mapping
- The EUVD record lists no CVE in its aliases. There is nothing to map to: work from the EUVD record and the advisories it references. KBrain only resolves EUVD records that cross-reference a CVE, so it reports these as not found.
- The record is newer than the last refresh. KBrain syncs the EUVD daily, so a record published today may not be found yet. Open it in the EUVD directly or try again after the next refresh.
- The ID is mistyped. KBrain expects EUVD-YYYY-NNNNN and says so when the format is wrong.
- The CVE exists but NVD has not analysed it yet. The CVE record can then lack a CVSS score or affected products; its NVD status shows where it stands.
How to cross-reference EUVD and CVE records in Claude
Connect the KBrain CVE brain to Claude (or ChatGPT, or any MCP compatible assistant) and ask in plain words. The brain has a dedicated EUVD lookup, so the assistant resolves the ID instead of guessing a mapping from memory.
- "Look up EUVD-2024-31989. Which CVE is it, what CVSS score do NVD and the EUVD give it, and is it being exploited?"
- "Here are five EUVD IDs from an ENISA advisory. Map each to its CVE and tell me which are in CISA KEV."
- "What is the EUVD ID for CVE-2024-3400?" The reverse lookup works too: a CVE answer includes its EUVD ID when one exists.
Expect the answer to include these fields:
| Field | What it tells you |
|---|---|
| CVE ID and EUVD ID | The cross-reference itself, both identifiers side by side. |
| NVD description, CVSS and CWE | Score, severity, vector and weakness, plus the NVD analysis status. |
| EUVD base score and exploited flag | ENISA's score, whether it marks the vulnerability as exploited and since when, and when the EUVD record was last updated. |
| CISA KEV | Whether it is in the Known Exploited Vulnerabilities catalog, the date added, the due date and known ransomware use. |
| EPSS | The probability of exploitation in the next 30 days, its percentile and the score date. |
| References and affected products | Vendor advisories, exploit write-ups and the affected product versions (CPEs). |
EUVD vs NVD at a glance
| Aspect | EUVD | NVD |
|---|---|---|
| Identifier format | EUVD-YYYY-NNNNN | CVE-YYYY-NNNN (four or more digits) |
| Run by | ENISA, the EU Agency for Cybersecurity | NIST, the US National Institute of Standards and Technology |
| Coverage | Vulnerabilities relevant to the EU, aggregated from several sources, launched in 2025 under NIS2 | Records for CVEs published by the CVE Program |
| Publication timing | Each record has its own published and updated dates | Each record has its own published and modified dates; the two databases update independently |
| CVSS | Base score, version and vector on the record | Score, severity and vector, from NVD analysis or the CVE numbering authority |
| Exploitation | An exploited flag with an exploited-since date | No exploitation flag of its own; shows CISA KEV data for CVEs in the catalog |
| Cross-reference | Lists the CVE in its aliases when one exists | Keyed by CVE ID; KBrain attaches the EUVD ID when an EUVD record references the CVE |
When each one is useful
- Reach for NVD detail when you want the CVSS vector, CWE and affected-product analysis.
- Reach for the EUVD ID and cross-reference when you work under EU frameworks such as NIS2 or the Cyber Resilience Act, or need to line up an EU advisory with a CVE.
- For exploitation, use CISA KEV (confirmed exploited) and EPSS (likelihood) alongside the EUVD exploited flag.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Questions people ask.
What is an EUVD ID?
It is the identifier ENISA gives a record in the EU Vulnerability Database, in the form EUVD-YYYY-NNNNN, for example EUVD-2024-31989. It is separate from the CVE ID, which comes from the CVE Program.
How do I find the CVE for an EUVD ID?
Open the EUVD record and read its aliases: the CVE ID is listed there when one exists. With the KBrain CVE brain you can ask your assistant for the EUVD ID and it returns the CVE with its NVD, CISA KEV and EPSS detail.
Does every EUVD record have a CVE?
No. A record only maps to a CVE when it lists one in its aliases. When it lists none, there is no CVE to find, and KBrain reports the EUVD ID as not found.
Is the EUVD replacing NVD?
No. The EUVD is the EU database run by ENISA and NVD is the US database run by NIST. They describe largely the same vulnerabilities from two sides, and the EUVD cross-references CVEs rather than replacing them.
Can Claude cross-reference EUVD and CVE IDs?
Yes, with the KBrain CVE brain connected. Ask for an EUVD ID and Claude gets the matching CVE; ask for a CVE and the answer includes its EUVD ID when one exists. It works the same in ChatGPT and other MCP compatible assistants.