Regional Risk Watch (EU/UK)Standing
Regional risk watch: the EU and US agree on severity 94% of the time
Updated 12 October 2026 · Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 94% of the 75,023 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
Why it matters
A 'the EU disagrees with US severity' headline drives real triage under NIS2 and DORA, and it is mostly false. NVD now publishes its own score for barely a third of CVEs; the rest carry only the assigning authority's score, which both NVD and the EUVD pass through. The apparent gap is CVSS 4.0 versus 3.1, not a European re-assessment.
What to do
- Security leaders. Do not treat an EU-vs-US severity gap as a second opinion; it is usually a CVSS version difference. If you compare, compare same-version.
- Lean IT orgs. Ignore EU-vs-US score gaps unless the CVSS versions match; the difference is the formula, not the risk.
- MSPs. When a client asks why the EU severity differs, explain the CVSS 4.0-vs-3.1 sourcing, not a European re-rating.
Our take
Reading the data correctly is the product. The regional story is not disagreement, it is that the disagreement is manufactured by mixing CVSS versions.
Earlier issues
Past states of this signal, most recent first.
12 October 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 71,043 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
07 October 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 68,839 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
02 October 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 67,173 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
27 September 2026 Regional risk watch: the EU and US agree on severity 94% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 94% of the 64,959 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
22 September 2026 Regional risk watch: the EU and US agree on severity 94% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 94% of the 63,293 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
17 September 2026 Regional risk watch: the EU and US agree on severity 94% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 28% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 94% of the 61,376 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
12 September 2026 Regional risk watch: the EU and US agree on severity 94% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 29% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 94% of the 58,021 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
07 September 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 29% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 55,097 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
02 September 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 29% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 53,912 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
28 August 2026 Regional risk watch: the EU and US agree on severity 94% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 29% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 94% of the 52,049 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
22 August 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 29% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 50,224 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.
17 August 2026 Regional risk watch: the EU and US agree on severity 93% of the time
Timeframe: Year to date (2026)
A raw comparison of ENISA's EUVD against the US NVD suggests they disagree on 30% of this year's CVEs. That figure is an artifact. The EUVD reports the CVSS 4.0 score the assigning authority supplied; NVD reports the 3.1 score; and 4.0 scores about half a point lower on the same flaw. Compare like-for-like, at the same CVSS version, and the two agree on 93% of the 47,289 CVEs both have scored this year. The EU is not re-rating vulnerabilities, it is surfacing the same vendor-assigned scores in a newer format.