For open source maintainers
Managed Article 14 reporting of the Cyber Resilience Act
Starting September 11, 2026, the CRA Article 14 requires software maintainers to report actively exploited vulnerabilities and severe incidents to the EU within 24 hours of becoming aware of them. Patchstack provides known exploited vulnerability tracking & managed Article 14 reporting to EU for free.
European Cyber Resilience Act which now requires all businesses in Europe to have an overview of the security state of their software.
How much does mVDP cost?
It's free, but you can customize your mVDP program and ask to set up a bounty pool with custom scopes and rules to motivate security researchers. You can set any bounty pool for your private VDP program, but additional rules and obligations apply to ensure your private program meets industry standards.
What do I need to activate the mVDP?
The first step is to submit your plugin or theme to the mVDP program and provide contact information for technical contacts about reports. To activate the program, your plugin/theme page or vulnerability disclosure policy should include information about the program and where to report vulnerabilities for a particular product – the VDP page we generate for each plugin or theme submitted to the mVDP program.
If you have questions, don't hesitate to reach out via mvdp@patchstack.com.