Regional Risk Watch (EU/UK)Standing
Regional risk watch: the EU and US agree on severity 93% of the time
Updated 12 August 2026 · Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 30% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 44,977 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
Why it matters
A 'the EU disagrees with US severity' headline drives real triage under NIS2 and DORA, and it is mostly false. NVD now publishes its own score for barely a third of CVEs; the rest carry only the assigning authority's score, which both NVD and the EUVD pass through. The apparent gap is CVSS 4.0 versus 3.1, not a European re-assessment.
What to do
- Security leaders. Do not treat an EU-vs-US severity gap as a second opinion; it is usually a CVSS version difference. If you compare, compare same-version.
- Lean IT orgs. Ignore EU-vs-US score gaps unless the CVSS versions match; the difference is the formula, not the risk.
- MSPs. When a client asks why the EU severity differs, explain the CVSS 4.0-vs-3.1 sourcing, not a European re-rating.
Our take
Reading the data correctly is the product. The regional story is not disagreement, it is that the disagreement is manufactured by mixing CVSS versions.
Earlier issues
Past states of this signal, most recent first.
08 August 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 31% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 43,639 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
03 August 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 31% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 41,817 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
29 July 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 32% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 40,458 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
24 July 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 32% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 39,319 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.