jeremylong/open-vulnerability-data-mirror (9.0.2 at the time).
At some point, my 2011 nvdcve files were removed from the cache directory. I don't know how or why. Nothing else touches this directory but vulnz (it's a dedicated Docker volume).
However, nothing also seems to be bringing the files back.
/validate.sh finds no problems.
/mirror.sh and /mirror-all.sh complete quickly (few seconds), and do not attempt to put the files back.
The only things I can find in the logs are (reverse log order):
Apr 27 06:12:08 ip-10-44-51-143.us-west-2.compute.internal 687356a076ff[2079]: 172.22.0.1 - - [27/Apr/2026:06:12:08 +0000] "GET /nvdcve-2011.json.gz HTTP/1.1" 404 196
Apr 26 15:08:57 ip-10-44-51-143.us-west-2.compute.internal dc4188998f39[2079]: 2026-04-26 15:08:57,022 INFO [NistMirrorTask] Downloading...
Apr 26 15:08:56 ip-10-44-51-143.us-west-2.compute.internal dc4188998f39[2079]: 2026-04-26 15:08:56,929 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/2.0/nvdcve-2.0-2011.meta
Apr 26 15:08:56 ip-10-44-51-143.us-west-2.compute.internal dc4188998f39[2079]: 2026-04-26 15:08:56,928 INFO [NistMirrorTask] Retrieval of nvdcve-2.0-2011.json.gz not necessary. Will use modified feed for updates.
Apr 25 20:43:07 ip-10-44-51-143.us-west-2.compute.internal 687356a076ff[2079]: 172.22.0.1 - - [25/Apr/2026:20:43:07 +0000] "GET /nvdcve-2011.json.gz HTTP/1.1" 404 196
Apr 24 06:22:09 ip-10-44-51-143.us-west-2.compute.internal 687356a076ff[2079]: 172.22.0.1 - - [24/Apr/2026:06:22:09 +0000] "GET /nvdcve-2011.json.gz HTTP/1.1" 404 196
Apr 23 20:43:06 ip-10-44-51-143.us-west-2.compute.internal 687356a076ff[2079]: 172.22.0.1 - - [23/Apr/2026:20:43:06 +0000] "GET /nvdcve-2011.json.gz HTTP/1.1" 200 3506171
From the logs I can only see that the file was there, then disappeared, between these last two timestamps there is no mention of that file, and vulnz "thinks" that the file is "up to date" and doesn't need refreshing.
The only way that I found to get the files back (short of manually downloading them and placing them where they belong), was to blow everything from the cache directory and invoke /mirror.sh
I upgraded to 9.0.4 just now, if 2011 files are missing, /validate.sh and /mirror.sh behave the same - validation is OK, and no attempt to fetch respectively.
jeremylong/open-vulnerability-data-mirror (9.0.2 at the time).
At some point, my 2011 nvdcve files were removed from the cache directory. I don't know how or why. Nothing else touches this directory but vulnz (it's a dedicated Docker volume).
However, nothing also seems to be bringing the files back.
/validate.sh finds no problems.
/mirror.sh and /mirror-all.sh complete quickly (few seconds), and do not attempt to put the files back.
The only things I can find in the logs are (reverse log order):
From the logs I can only see that the file was there, then disappeared, between these last two timestamps there is no mention of that file, and vulnz "thinks" that the file is "up to date" and doesn't need refreshing.
The only way that I found to get the files back (short of manually downloading them and placing them where they belong), was to blow everything from the cache directory and invoke /mirror.sh
I upgraded to 9.0.4 just now, if 2011 files are missing, /validate.sh and /mirror.sh behave the same - validation is OK, and no attempt to fetch respectively.