ENISA, the EUVD, and CRA reporting
ENISA operates the reporting and vulnerability infrastructure at the centre of the Cyber Resilience Act. Here is how each touchpoint works and how the platform aligns with it.
ENISA's role under the CRA
Under Article 14 of the Cyber Resilience Act, a manufacturer that becomes aware of an actively exploited vulnerability in a product with digital elements must notify the coordinating CSIRT and ENISA through a single reporting platform. An early warning is due within 24 hours, a fuller notification within 72 hours, and a final report once the vulnerability is handled. ENISA also runs the European Vulnerability Database, the EU's public record of critical and exploited vulnerabilities.
CVD Portal is an independent platform and is not affiliated with or endorsed by ENISA or the EU. It aligns with these touchpoints so a manufacturer can meet the obligation with less manual effort.
ENISA also publishes engineering guidance, separately from its reporting infrastructure role. The Secure by Design and Default Playbook is 22 playbooks covering product security across the life cycle, mapped there to the Annex I requirements each one evidences.
Getting access to the SRP
ENISA published the operational guidance for the Single Reporting Platform on 31 July 2026, as separate documents covering authorised-representative user registration and notification submission, plus a two-page reporting factsheet. Three points from it change how manufacturers should prepare.
- Access runs through EU Login. You sign in to the platform with a European Commission EU Login account, and the account can be created now. This applies to manufacturers and to the authorised representatives of open-source software stewards alike.
- Your coordinating CSIRT validates your reporters. ENISA states that the CSIRT designated as coordinator confirms that a representative may submit on behalf of a specific manufacturer, and that this happens after first access rather than as a box you can tick in advance.
- There is no submission API. ENISA states that no application programming interfaces will be provided at this stage. Every notification is filed by a person, inside a 24-hour window that can open at any hour.
The platform became operational on 11 September 2026, the same day the reporting obligation started to apply. ENISA advises registering only when you need to submit a notification. ENISA SRP guidance and FAQ.
Touchpoints and platform alignment
ENISA Single Reporting Platform
Where manufacturers file the Article 14 notifications for actively exploited vulnerabilities and severe incidents.
The platform runs the full Article 14 cascade: early warning within 24 hours, notification within 72 hours, and a final report, each with its own deadline timer. It generates a pre-filled ENISA submission package ready to paste into the Single Reporting Platform.
European Vulnerability Database (EUVD)
ENISA's public database of vulnerabilities, including critical and actively exploited entries.
CVD Portal pulls the live EUVD feeds directly from ENISA and uses them for monitoring and impact assessment against your SBOM. The feed below is the same source.
National CSIRTs
The Article 14 notification also goes to the CSIRT designated as coordinator in the manufacturer's member state.
The platform derives the correct national CSIRT and its Article 14 contact from a per-country directory, so the notification is routed to the right coordinator.
CSAF 2.0 advisories
Machine-readable security advisories that align with the EU move toward automated vulnerability information exchange.
CVD Portal generates CSAF 2.0 VEX advisories and publishes a provider metadata feed, so disclosures are machine-readable for downstream consumers.
EU Vulnerability Database (EUVD) Pulse
Official feed of the latest critical and actively exploited vulnerabilities tracked by European authorities.
Latest Critical Vulnerabilities
CVSS 9.0+Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
Actively Exploited (KEV)
In the wildThe vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Be ready for the 24-hour clock
Run Article 14 reporting with deadline timers and a pre-filled ENISA submission package.