Questions
Questions about Vulnio and the CRA
Is this legal advice?
No. Vulnio shows what the regulation says, with article numbers, and what the public vulnerability sources say. Whether something must be reported is your decision as the manufacturer. Where the scope check says "unclear", ask a lawyer.
Does Vulnio report to ENISA for me?
No. ENISA's Single Reporting Platform has no API at this stage (ENISA FAQ); reports are entered on the platform by your assigned representative. Vulnio prepares the text in the order of the platform's fields so you can paste it.
When does the 24-hour period start?
When the manufacturer becomes aware of the actively exploited vulnerability or severe incident (Art. 14(2) and (4)). The regulation does not define "aware". Vulnio counts all deadlines from the time you enter. ENISA's platform currently counts its 72-hour timer from the early warning, so it can show a later time than the regulation.
Does a CISA KEV or EUVD match mean I must report?
Not by itself. Art. 14 is about vulnerabilities contained in your product for which there is reliable evidence of exploitation (Art. 3(42)). A listing tells you that exploitation happens somewhere; you check whether the vulnerable code is in your product and reachable.
Are small companies exempt?
No. Reporting applies to every manufacturer of a product in scope. Micro and small enterprises cannot be fined for missing the 24-hour early warning deadline (Art. 64(10)); the 72-hour notification and the final report still apply.
What happens to the file I upload?
It is read in memory and discarded. Vulnio keeps the component names, versions and package URLs and the matches. One-off scans are deleted after 30 days. The component list is sent to OSV.dev to look up vulnerabilities; nothing that identifies you is sent.
Where does the vulnerability data come from?
Known vulnerabilities from OSV.dev. Actively exploited lists from the CISA Known Exploited Vulnerabilities catalog and the ENISA EU Vulnerability Database, refreshed twice a day.
Is browser-only SaaS covered?
The regulation does not settle it clearly. Recital 12 points SaaS to the NIS2 Directive, but a product with an installed client, agent or app can bring its backend in as "remote data processing" (Art. 3(2)). The scope check answers "unclear" for this case.
What is not included yet?
Templates for the technical documentation and the EU declaration of conformity, and a GitHub app. They are planned for a later version.