Why your OpenVAS PDF report is missing CVEs (and how to fix it)

The symptom

You run a scan in Greenbone Community Edition or a Greenbone appliance, download the PDF, and the report shows hosts and result summaries but few or no CVE identifiers. Sometimes the totals at the top count critical results that never appear in the tables below. Both problems come up repeatedly on the Greenbone community forum, and both have ordinary causes.

Cause 1: the PDF format leaves details out

Greenbone generates reports through report formats. The long-standing PDF format is built for a human-readable summary and is not where Greenbone puts its maintenance effort; forum maintainers have confirmed that it can omit CVE details the other formats include. The XML, CSV and TXT formats carry the full reference list for each result.

Cause 2: the report filter hides results

Every Greenbone report is generated through a results filter. The default filter typically includes min_qod=70, which hides results whose Quality of Detection is below 70 percent. QoD expresses how reliable the detection method is: a remote banner check scores lower than an authenticated package check. Filters can also apply severity thresholds, a row limit (rows=) or hide overridden results.

• Open the report in the web interface and look at the filter string before downloading.
• Lower or remove min_qod if you need the complete picture, then label low-QoD results as lower-confidence in your report.
• Remove the row limit so large reports are not truncated.
• Check whether overrides or false-positive markings changed severities.

Cause 3: the check has no CVE

Many Greenbone NVTs test for things that never received a CVE: deprecated TLS versions, weak SSH algorithms, default credentials, end-of-life operating systems, exposed services. Those results are real findings with an OID and a severity but an empty CVE list. A report that counts only CVE-backed findings will under-report them.

Varaxon Scan Hub reports CVE-based assessment for those findings as Unknown rather than zero, and can optionally map Greenbone OIDs to CVEs on the server where a reliable mapping exists. Either way the gap stays visible.

A checklist before you send a Greenbone report

1. Confirm the scan used credentials for the hosts where you expect local checks.
2. Check the filter: QoD threshold, severity threshold, row limit, overrides.
3. Download the XML report.
4. Compare the result count in the XML with the count shown in the web interface.
5. State in the report which results have no CVE and how they were prioritized.

Upload the XML to Varaxon Scan Hub to get a prioritized, client-ready report from it. The Greenbone / OpenVAS page and its sample report show the result.

Common questions