EUVD CLI

Query the ENISA EU Vulnerability Database (EUVD) from the command line and from Python

Overview

EUVD CLI is both a command-line tool and a Python library that fetches vulnerabilities, advisories, and KEV entries from the ENISA EU Vulnerability Database, validates the responses with Pydantic, and emits JSON or SARIF 2.1 output. The same client and validation rules apply when used as a library.

Current feature set

Supported endpoints

Base URL: https://euvdservices.enisa.europa.eu/api.

Installation

From PyPI

pip install euvd-python-cli

From source

git clone https://github.com/seifreed/euvd-cli.git
cd euvd-cli
python3 -m venv venv
source venv/bin/activate
pip install -e .

Development

pip install -e ".[dev]"

Quick start

euvd-cli latest
euvd-cli critical
euvd-cli exploited
euvd-cli search-enisa EUVD-2025-4893
euvd-cli search-advisory oxas-adv-2024-0002
euvd-cli search --text "OpenSSL" --from-score 7.0 --size 20
euvd-cli stats
euvd-cli kev-dump --save
euvd-cli --format sarif latest > latest.sarif.json

CLI usage

Inputs

euvd-cli latest
euvd-cli critical
euvd-cli exploited
euvd-cli search-enisa EUVD-2025-4893
euvd-cli search-advisory oxas-adv-2024-0002
euvd-cli kev-dump

Search

euvd-cli search --text "Windows" --size 10
euvd-cli search --exploited --size 5
euvd-cli search --from-score 9.0 --to-score 10.0
euvd-cli search --from-date 2024-01-01 --to-date 2024-12-31
euvd-cli search --from-epss 50 --to-epss 100

Output formats

The --format flag is on the group, before the subcommand. Supported: json (default, indented), jsonl (one JSON object per line), csv, toon (Token-Oriented Object Notation, requires pip install "euvd-python-cli[toon]" --pre), sarif (SARIF 2.1).

euvd-cli --format json  latest
euvd-cli --format jsonl latest
euvd-cli --format csv   latest
euvd-cli --format toon  latest
euvd-cli --format sarif search-advisory oxas-adv-2024-0002

For search, the jsonl and csv formats emit only the items (the total wrapper is dropped because flat formats can't represent it).

Save to file

euvd-cli kev-dump -o kev.json
euvd-cli kev-dump --save                           # kev_dump_YYYYMMDD_HHMMSS.json
euvd-cli --format sarif kev-dump -o kev.sarif.json

Statistics and self-test

euvd-cli stats
euvd-cli selftest

Common options

Python library

from euvd_python import EUVDAPIClient, SearchFilters, to_sarif_json

with EUVDAPIClient() as client:
    latest = client.get_latest_vulnerabilities()
    advisory = client.get_advisory_by_id("oxas-adv-2024-0002")
    results = client.search_vulnerabilities(
        SearchFilters(text="OpenSSL", from_score=7.0, size=20)
    )

sarif_json = to_sarif_json(latest)

The same validation rules apply: SearchFilters rejects out-of-range CVSS/EPSS, non-ISO dates, inverted ranges, and out-of-bounds size before the request is made.

Public API

from euvd_python import (
    EUVDAPIClient,
    RateLimiter,
    APIResponseError,
    API_ERRORS,
    SearchFilters,
    LatestVulnerability,
    CriticalVulnerability,
    ExploitedVulnerability,
    SearchResultVulnerability,
    ENISAVulnerabilityByID,
    VulnerabilityByID,
    AdvisoryByID,
    AdvisorySource,
    KevEntry,
    VulnerabilityQueryResponse,
    to_sarif_json,
    SARIFConversionError,
    CVSS_CRITICAL_THRESHOLD,
    CVSS_HIGH_THRESHOLD,
    CVSS_MEDIUM_THRESHOLD,
)

Importing euvd_python does not load Click, does not load rich.console, and does not install signal handlers. Those are only loaded by euvd_python.cli and euvd_python.main, which library users have no reason to import.

Output notes

• JSON: pretty-printed with indent=2, written via sys.stdout.write so the output is pipe-safe and free of ANSI escapes.
• SARIF: SARIF 2.1 with stable rule deduplication, EPSS mapped to rank on the API's native 0-100 scale, severity derived from CVSS thresholds.
• Diagnostics (banner, "Fetching...", "Saved to...", error messages) all go to stderr so stdout stays parseable.
• Models preserve unknown wire fields via Pydantic extra="allow", so future EUVD additions show up in JSON output without a code change.

Validation

SearchFilters enforces all input invariants in one place:

Invalid input prints Invalid input: --<flag>: <reason> to stderr and exits 1, before any HTTP request.

Testing

euvd-cli selftest

The self-test hits the live EUVD API. There are no mocks — a passing self-test means real usage works against the real endpoints. CVSS/EPSS bounds, ISO date parsing, SARIF correctness, stream routing, signal handling, and library re-exports are all locked by synthetic checks within the same suite.

Quality gates run with default rules and zero suppressions:

black --check euvd_python/
ruff check euvd_python/
mypy euvd_python/
bandit -r euvd_python/
pip-audit -r requirements.txt

License

MIT — see LICENSE.

Author: Marc Rivero Lopez · mriverolopez@gmail.com