The Baby Steps of the European Union Vulnerability Database: An Empirical Inquiry

Abstract

A new European Union Vulnerability Database (EUVD) was introduced via a legislative act in 2022. The paper examines empirically the meta-data content of the new EUVD. According to the results, actively exploited vulnerabilities archived to the EUVD have been rather severe, having had also high exploitation prediction scores. In both respects they have also surpassed vulnerabilities coordinated by European public authorities. Regarding the European authorities, the Spanish public authority has been particularly active. With the exceptions of Finland, Poland, and Slovakia, other authorities have not engaged thus far. Also the involvement of the European Union's own cyber security agency has been limited. These points notwithstanding, European coordination and archiving to the EUVD exhibit a strong growth trend. With these results, the paper makes an empirical contribution to the ongoing work for better understanding European cyber security governance and practice.

Figures (4)

• Figure 1: Publication Dates of the Vulnerabilities
• Figure 2: Severity of the Vulnerabilities
• Figure 3: Most Frequent Bigrams in the Vulnerabilities' Descriptions
• Figure 6: Assigners of the Vulnerabilities