Under Article 17(5) of the Cyber Resilience Act (CRA), ENISA shall, in agreement with the manufacturer of the product with digital elements concerned, add the publicly known vulnerability notified pursuant to Article 14(1) or Article 15(1) of the CRA to the European Vulnerability Database (EUVD).

ENISA may contact the manufacturer to verify if and when the information can be added to the EUVD.

As ENISA is a CVE Numbering Authority, the Agency can also help assign a Common Vulnerabilities and Exposures (CVE) ID in accordance with the CVE Program rules.