For OWASP Dependency-Check

The NVD, ready to download

A static mirror of the NVD API datafeed – no API key, no pagination, no rate limiting – and complete Dependency-Check databases for H2, MariaDB/MySQL and PostgreSQL. Rebuilt every night.

Use the datafeed Download a database

Last update (UTC): 2026-10-19 09:47

Datafeed

Point Dependency-Check at the mirror

The NVD data as gzipped JSON, one file per year plus the recent changes. Dependency-Check downloads what is new – over plain HTTP, without an NVD API key.

dependency-check --updateonly \
  --nvdDatafeed https://nvd.epicsoft.one/nvdcve-{0}.json.gz

{0} stands for the year. Files: nvdcve-2002.json.gz … nvdcve-<year>.json.gz, nvdcve-modified.json.gz and cache.properties.

Databases

Skip the first update

The same data, already loaded by Dependency-Check: start from one of these files and the next run only fetches the changes. Built from the datafeed above every night, CISA's catalogue of known exploited vulnerabilities included.

State 2026-10-19 09:19 UTC 245,238 CVEs 1,748 known exploited Dependency-Check 13.0.0, schema 5.6

H2

H2 2.4.240 · 128 MiB

Dependency-Check's built-in database. Unpack it into the data directory: --data of the CLI, /usr/share/dependency-check/data in the Docker image.

odc.mv.db.gz · sha256

gunzip odc.mv.db.gz
mv odc.mv.db /usr/share/dependency-check/data/

MariaDB / MySQL

MariaDB 13.0.2, tested with MySQL 9.7.2 · 47 MiB

One dump for both servers, with Dependency-Check's procedures.

dependencycheck-mysql.sql.gz · sha256

mysql -e "CREATE DATABASE dependencycheck
  CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci"
gunzip -c dependencycheck-mysql.sql.gz | mysql dependencycheck

PostgreSQL

PostgreSQL 18.6 · 45 MiB

Plain SQL from pg_dump, without owner and grants. It uses \restrict, so import it with a current psql.

dependencycheck-postgres.sql.gz · sha256

createdb dependencycheck
gunzip -c dependencycheck-postgres.sql.gz \
  | psql -d dependencycheck

The files fit Dependency-Check 13.0.0 (database schema 5.6). Accounts and grants are not part of the SQL dumps – set up the database as in Using a Database Server. db.json lists versions, counts and checksums.

How it works

Built in the open, every night

From the NVD

vulnz fetches the changes from the NVD API and writes the datafeed. Before anything is published, every yearly file must be a valid gzip file.

Checked databases

Dependency-Check loads the new feed into H2, MariaDB and PostgreSQL from scratch. All three must agree with each other and with the feed, and the MySQL import is tested as well.

Open source

CI, scripts and this page are on GitLab, mirrored to GitHub, under the MIT License.