Configure National Vulnerability Database (NVD) Synchronization

Overview

Dependency-Track integrates with the National Vulnerability Database (NVD) to provide up-to-date CVE and vulnerability information.

This guide explains how to configure and verify NVD synchronization in your Dependency Track SaaS instance.

Prerequisites

Before configuring NVD synchronization, ensure you have:

• Access to the Dependency-Track Administration panel

Configuration Steps

1. Open NVD Configuration

Navigate to: Administration > Vulnerability Sources > National Vulnerability Database

2. Configure our internal Mirror URL (Optional)

For faster synchronization speeds and protection against frequent official NVD outages, our SaaS customers can optionally use our internal mirror feed (which synchronizes directly from the official upstream source at https://nvd.nist.gov/feeds/json/cve/2.0) by entering https://nvd-mirror.dependencytrack.cloud/feeds in the endpoint configuration field.

IMPORTANT — FOR CUSTOMERS ONLY
The NVD mirror URL resolves exclusively within our cluster and is available strictly to Dependency Track SaaS customers. It is NOT accessible from external networks or public environments.

3. Apply the Changes

1. Click Test Connection to verify the URL is accessible.
2. Enable the NVD feed.
3. Click Update to apply your configuration.

Synchronization will begin automatically after saving. No manual intervention is required after this initial setup.

Synchronization Timing

After enabling or updating the configuration:

• Initial synchronization may take some time to complete
• Subsequent updates occur automatically on a regular schedule

Data Consistency

Minor differences between your local data and the NVD database may occur due to synchronization timing. This is expected behavior.

If you observe significant or persistent discrepancies, review your configuration or contact support.

Troubleshooting

No vulnerability data is appearing

Check that:

• Synchronization is enabled
• The system has completed its initial synchronization cycle and displays a recent date in Last Modification field

Data appears outdated

• Ensure synchronization is enabled
• Click on Update button
• Allow time for the next update cycle to complete

Verify Vulnerability Counts

• Filter for CVEs and compare your total CVE count with the official NVD dashboard.
• If your count is significantly higher, other vulnerability sources (such as OSV) may also be active. You can search for identifiers like DEBIAN-CVE or UBUNTU-CVE to subtract distro-specific advisories from your baseline count.