Firmware Vulnerabilities not showing any 2026 CVEs on default data source

Question

Hi all,

I'm evaluating NCM on an existing Solawinds NPM platform. Version is 2026.1.1.

Firmware upgrade seems much better than the Manage Engine one as it has MD5 hash checks etc built in.

I'm now looking at Firmware Vulnerabilities side of things, but noticed not showing any 2026 vulnerabilities. It seems to have 2025 vulns so assume something has changed? I'm using the default data source

https://downloads.solarwinds.com/solarwinds/data/cve/cve-all.json.zip

Not sure if it's related but CoPilot tells me that NIST has stopped automatically assigning CVSS scores to most CVEs in April 2026 because the volume of vuln submissions far exceeded its capacity.

I'm only interested in Cisco PSIRT etc, is there any other CVE data sources that I can point to?

Please let me know.

Many thanks,

planglois · Answer

Please post the status on /apps/secobs/settings/vuln-db page. 2026 vulnerabiities are available when you update the feed.

cnorborg · Answer

Since its 2026.1.1, ie: the first version released in 2026, it would only have 2025 vulnerabilties.   Unless you download new ones.     Go into NCM settings / Firmware Vulnerability Settings and set things up there.   Normally, if your server can reach the Internet, it should update periodically.  But, if you're like me and your server is cut off from the Internet, you need to give it a alternate source and maybe download the files yourself.

But, you can check when it last downloaded, and whether its scheduled to download periodically also..