DependencyTrack / DependencyTrack/dependency-track

Add support for European Union Vulnerability Database (EUVD)

Open
#4,863 7 comments 48 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently Dependency Track uses the National Vulnerability Database to download vulnerabilty information.

### Proposed Behavior

Having in mind the recent "almost-shutdown" of the MITRE CVE Database (https://cve.mitre.org/), due to unclear financing, this could IMHO also happen to the National Vulnerability Database (https://nvd.nist.gov/) itself.

Recently the European Union has released an early beta version of the "Eurpean Union Vulnerability Database":
https://euvd.enisa.europa.eu/

Some news can be found here:
https://www.theregister.com/2025/04/18/splintering_cve_bug_tracking/

IMPORTANT:
Being in early beta, there is no EUVD API documentation yet.
Some reverse engineering efforts have been made (like here: https://github.com/cku-heise/euvd-api-doc) to get a basic understanding of the API.
Official documentation has been announced, though.

From my point of view, it would be a good idea to also support the EUVD as a selectable alternative to the NVD - as soon as the API is officially documented.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.