Vulnerability Coordination in the EU

on YouTube ↗58m

" summary

ENISA implements an EU vulnerability database that pulls and normalizes advisories from 27 member states and ~40 national CSIRTs (about 600 members), uses CSAF as the preferred exchange format, hosts code and bulletins on GitHub, and prioritizes EU-reported or Europe-impacting bugs. The project starts mid-year testing with a target production roll‑out by year end/early next year, includes registering CVE IDs for EU companies and is considering a root CNA role; data is machine‑readable and enriched with contextual assessments.

AI-written summary · about

" chapters (9)

1. 0:00Vulnerability coordination intro
2. 1:23What ENISA does
3. 8:16ENISA’s mission
4. 13:13EU legislation on vulnerabilities
5. 17:31EU disclosure policies
6. 22:46CERTs and coordination
7. 29:05Vulnerability coordination state
8. 34:05EU vulnerability database
9. 40:28Q&A

" related talks

• 32mStepping up the ENISA's role in Support of EU Vulnerability ServicesJohannes Kaspar Clos · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 48mCISA-ENISA Joint MessagingLindsey Cerkovnik, Nuno Rodrigues Carvalho · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 37mGoverning Global Vulnerabilities: Standards for Open Source ResilienceYogesh Mittal · DevConf.IN 2026
• 56mCISA’s North Star Vision for the CVE ProgramBen Edwards, Bob Lord, Alec Summers, Sandy Radesky · CVE/FIRST VulnCon 2025
• 45mNational CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination CasesMichał Dondajewski · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 24mSecurity Advisories and Vulnerability Prioritization in the WildXander Bouman, Stephanie de Smale, Rik van Dijk · 33rd Annual FIRST Conference (Virtual Event)
• 31mEfficient Vulnerability Management in Hierarchical Supply ChainsThomas Kittel, Tobias Limmer · CVE/FIRST VulnCon 2025
• 37mEUs Efforts to Secure Open Source SoftwareCiara Carey · OSPOCon @ Open Source Summit Europe 2022