The EU vulnerability database, managed and maintained by ENISA, contains information on publicly known vulnerabilities in ICT products and services. The goal of the database is to improve cybersecurity by centralizing information on vulnerabilities and making it accessible to all stakeholders.

According to the sources, the database includes the following information:

• Information illustrating the vulnerability: Although the sources do not delve into specific details, this likely refers to a detailed description of the vulnerability, its potential impact, and exploitation methods.
• Affected ICT products or services and vulnerability severity: This includes a specific list of products and services impacted by the vulnerability and an assessment of its severity based on the circumstances of potential exploitation. This helps users understand the risks associated with the vulnerability and prioritize mitigation efforts.
• Availability of patches, and in their absence, guidelines from competent authorities or CSIRTs to mitigate risks: This ensures that users have access to resolution steps. If patches are not available, the database provides guidance from authorities such as CSIRTs on how to mitigate risks until a patch is released. This guidance may include temporary workarounds, security configurations, or alternative solutions.

The sources emphasize that entities can voluntarily disclose and register publicly known vulnerabilities in the EU vulnerability database. This voluntary disclosure aims to promote a culture of cybersecurity and encourage collaboration among stakeholders. For organizations falling within the scope of the directive, understanding these obligations is part of a broader NIS2 compliance journey that includes vulnerability management, incident notification, and risk-proportionate security measures. You can learn more about the regulatory framework in the article on the main objective of the NIS2 Directive.