Bad CVE URLs generated

[stealthrabbi]

Description

In the text report of trivy, a CVE gets reported with a details link of https://avd.aquasec.com/nvd/cve-2026-42311,, for example. But this URL is invalid, and it should link to https://avd.aquasec.com/nvd/2021/cve-2021-42311/

Desired Behavior

A valid URL is provided for the CVE

Actual Behavior

An invalid URL is provided for the CVE -- navigating to the page gives a 404 error.

Reproduction Steps

Generate a text report of a docker iamge that has vulnerabilties. Observe that the generated CVE links are bad.

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Debug Output

v0.69.2

Operating System

Linux

Version

v0.69.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @stealthrabbi ! Thanks for the report.

This isn't a URL-format issue — the link format is correct, the page just doesn't exist yet because the AVD site hasn't been rebuilt recently. The scheduled job that regenerates and deploys the site has been failing, so newly published CVEs don't have pages yet (hence the 404).

We're aware of it and working on a fix to the build pipeline. Once the site rebuilds, the missing CVE pages will appear. I'll follow up here when it's back to updating normally.

[stealthrabbi]

Thank you!

[nikpivkin]

Fixed

❯ curl -LsS -o /dev/null -w "%{http_code}\n" https://avd.aquasec.com/nvd/cve-2026-42311
200