ENISA EU Vulnerability Database API

Freeauth: noneunknown#cyber-threat#vulnerabilities#risk#real-time

ENISA EU Vulnerability Database API

The European Union Agency for Cybersecurity's EU Vulnerability Database (EUVD) is the official EU repository for vulnerability intelligence. Its keyless JSON API returns EUVD identifiers, descriptions, publication and update timestamps, CVSS scores and vectors, references, CVE and GHSA aliases, assigners, EPSS values, and affected vendors and products. No account or API key is required.

Coverage

Vulnerabilities aggregated and enriched by ENISA, including records relevant to products and services used in the EU. The API exposes recent, exploited and critical-vulnerability lists plus record lookup and search. Granularity: one vulnerability record, with aliases and affected-product relationships. Free history depth: Not stated. Delay: Not stated. The recent-vulnerabilities endpoint returned records updated on 2026-11-04 when checked. Update frequency: Not stated.

Verdict

This is an EU-centred vulnerability signal for matching software inventories and supplier exposure to EUVD, CVE and GHSA identifiers, CVSS and EPSS context. Treat scores as triage inputs rather than proof of exploitation, and follow the cited vendor or coordinator references for remediation. ENISA publishes a working public API but no data reuse licence or API rate limit was stated on the provider pages checked.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

Use in your agent

Load recent EUVD vulnerability records into pandas and Parquet. Checked against the provider's documentation on Nov 4, 2026.

Raw skill file (/skills/enisa-euvd-api.md)Also in our MCP server: call get_ingestion_skill with {"slug": "enisa-euvd-api"}.

Access

No account or key. The ENISA EUVD services host returns JSON over HTTPS.

Request

bash

curl 'https://euvdservices.enisa.europa.eu/api/lastvulnerabilities'

Format

JSON array with EUVD ID, description, publication and update times, CVSS score/vector, references, aliases, assigner, EPSS and nested vendor/product relationships.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python

"""Recent ENISA EUVD records -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://euvdservices.enisa.europa.eu/api/lastvulnerabilities"
r = requests.get(URL, timeout=60)
r.raise_for_status()
df = pd.json_normalize(r.json(), sep=".")
keep = [c for c in ["id", "datePublished", "dateUpdated", "baseScore", "baseScoreVersion", "baseScoreVector", "aliases", "assigner", "epss"] if c in df]
df[keep].to_parquet("euvd_recent.parquet", index=False)
latest = pd.to_datetime(df["dateUpdated"], format="mixed").max().isoformat()
print(len(df), "recent EUVD records; latest update", latest)

Run by us on 2026-11-04 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 4 recent EUVD records; latest update 2026-11-04T16:41:17

Limits

Rate limits: Not stated.
A data reuse licence was not stated on the EUVD pages checked.

Quirks

Aliases and references are newline-delimited strings.
Vendor and product relationships are nested arrays.
CVSS versions vary; retain the version and vector.

Terms and attribution

ENISA exposes the API publicly without a key.
Reuse licence: Not stated.

Sources

https://euvd.enisa.europa.eu/: “EU Vulnerability Database (EUVD) - the official EU repository for timely, curated cybersecurity vulnerability intelligence and remediation guidance.”
https://euvdservices.enisa.europa.eu/api/lastvulnerabilities: “baseScoreVector”

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

ENISA EU Vulnerability Database API