KBrain Concepts
EUVD vs NVD: how the EU vulnerability database compares
EUVD and NVD both describe vulnerabilities, but one is the EU database (ENISA) and the other is the US database (NIST). Here is how they relate, and how to use both from your AI assistant.
Add the CVE brain to your AI assistant
The EU Vulnerability Database (EUVD) and the National Vulnerability Database (NVD) both describe software vulnerabilities, and both are organised around CVE ids. The difference is who runs them and the perspective they add. NVD is run by NIST in the US; the EUVD is run by ENISA for the EU. They are not competitors so much as two references over the same underlying CVEs.
What each one is
- NVD (NIST, US): enriches each CVE with a description, CVSS score and vector, weakness (CWE), affected products (CPEs), and references. It is the reference most tools have used for years.
- EUVD (ENISA, EU): the EU's vulnerability database, launched in 2025 in the context of NIS2. It assigns EUVD ids, cross-references the CVE, and aggregates vulnerability data with an EU perspective.
How they overlap
Because both are keyed to CVEs, most vulnerabilities appear in both, and the core facts are similar since they draw on shared sources. An EUVD entry lists the CVE id in its aliases, so you can always tie an EUVD id back to the CVE and its NVD detail.
When each is useful
- Reach for NVD detail when you want the canonical CVSS, CWE, and affected-product analysis.
- Reach for the EUVD id and cross-reference when you work under EU frameworks or need to line up an EU advisory with a CVE.
- For exploitation, neither replaces CISA KEV (confirmed exploited) or EPSS (likelihood); use those regardless.
You do not have to choose. The CVE brain returns the NVD record with the EUVD cross-reference attached, so one lookup covers both the US and EU views.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
Is the EUVD replacing NVD?
No. The EUVD is the EU's own database run by ENISA, and NVD is the US database run by NIST. Both are organised around CVE ids and largely overlap; the EUVD adds an EU identifier and perspective rather than replacing NVD.
Do EUVD and NVD have the same data?
They are similar for most vulnerabilities because they draw on shared CVE sources, but each adds its own identifier and context. The EUVD cross-references the CVE, so you can always line the two up.
Which should I use?
Use NVD for the canonical CVSS, CWE, and affected-product detail, and the EUVD id when you need the EU cross-reference. The CVE brain returns both in one lookup, so you do not have to pick.