Skip to content

Create a provider for the ENISA EUVD data #915

@westonsteimel

Description

@westonsteimel

What would you like to be added:
Create a vunnel provider to start building a cache of the ENISA EUVD data.

Why is this needed:
An additional source of data for future resilience against gaps in the CVE/NVD data and supporting regulations which may mandate alternative identifier useage in future.

Additional context:
There is an api that can be queried to retrieve all of the data. It will probably take awhile on the initial run; however, similar to the NVD json api, after the initial run we can ask for a specific starting range going forward to make future runs much more efficient. The json format is not particularly nice, it has some strange attributes. It appears to jsut be a json rendering of the html, so, for instance, rather than aliases being a list of strings it is a string delimited by \n. We can decide how much we want to transform the data here into a more consumable schema.

An example of the GET request to use, maximum page size supported is 100
https://euvdservices.enisa.europa.eu/api/search?fromDate=&toDate=&fromUpdatedDate=&toUpdatedDate=&page=0&size=100

Sample json result shape

{
  "items": [
    {
      "id": "EUVD-2025-37524",
      "enisaUuid": "0e44d878-b2d4-3f69-81dd-2a05e70a9833",
      "description": "Malicious code in antora-navigator-extension (npm)",
      "datePublished": "Nov 3, 2025, 11:25:38 PM",
      "dateUpdated": "Nov 3, 2025, 11:25:38 PM",
      "baseScore": 0.0,
      "aliases": "MAL-2025-49348\n",
      "epss": 0.0,
      "enisaIdProduct": [],
      "enisaIdVendor": []
    },
    {
      "id": "EUVD-2025-24007",
      "enisaUuid": "ae13e0a4-49e6-3bea-b513-11e0cf9eecc5",
      "description": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison.",
      "datePublished": "Aug 8, 2025, 6:02:07 PM",
      "dateUpdated": "Nov 3, 2025, 11:19:28 PM",
      "baseScore": 4.8,
      "baseScoreVersion": "4.0",
      "baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "references": "https://vuldb.com/?id.319230\nhttps://vuldb.com/?ctiid.319230\nhttps://vuldb.com/?submit.622300\nhttps://github.com/akimd/bison/issues/115\nhttps://drive.google.com/file/d/123Qe44FaC-GP88dWNl9-6H4jLWUcXYNZ/view?usp=drive_link\nhttps://www.gnu.org/\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-8734\nhttps://www.openwall.com/lists/oss-security/2025/10/27/12\n",
      "aliases": "CVE-2025-8734\n",
      "assigner": "VulDB",
      "epss": 0.02,
      "enisaIdProduct": [
        {
          "id": "2e4dd340-0438-341a-b964-4c290b566360",
          "product": {
            "name": "Bison"
          },
          "product_version": "3.8.1"
        },
        {
          "id": "71e561c8-edd6-31ae-8180-6570ebd60ec8",
          "product": {
            "name": "Bison"
          },
          "product_version": "3.8.0"
        },
        {
          "id": "b9e4f873-45c5-39d3-8b57-9c21f77955a2",
          "product": {
            "name": "Bison"
          },
          "product_version": "3.8.2"
        }
      ],
      "enisaIdVendor": [
        {
          "id": "8d7ee90d-9c46-3b6f-a16f-21cda339d923",
          "vendor": {
            "name": "GNU"
          }
        }
      ]
    }
  ],
  "total": 289851
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions