New VT creation dropped sharply in 2026-01 — intended change?

Community Discussion and Feedback
1

Hi,

On a source-built Community Edition I noticed that the number of newly
created VTs collapsed in January 2026 and has not recovered. I could not find
an announcement about it, so I would like to check whether it is intended.

    290 2025-01
    166 2025-02
    132 2025-03
    160 2025-04
    351 2025-05
    119 2025-06
    184 2025-07
    114 2025-08
    123 2025-09
    144 2025-10
     92 2025-11
    121 2025-12
     39 2026-01
      1 2026-02
      3 2026-03
      3 2026-04
      1 2026-05
      3 2026-07

grep -rho 'creation_date", value:"[0-9-]*' /var/lib/openvas/plugins --include='*.nasl' \
  | grep -oE '202[56]-[0-9]{2}' | sort | uniq -c

Two categories stopped completely after 2026-01: Windows : Microsoft Bulletins (previously 9–21 per month) and Microsoft Edge (3–5 per month). The
last Edge VT is gb_microsoft_edge_chromium_based_insufficient_policy_enforcement_vuln_jan26.

Across the whole feed, 1276 VTs reference a CVE-2025 ID but only 34 reference
CVE-2026. Notus looks unaffected — it carries 50k+ CVE-2026 references and was
updated yesterday — so this seems specific to the NASL side.

Questions

  1. Is the drop since 2026-01 intended, e.g. content moving to the Enterprise Feed?
  2. Should Community users still expect new tests for monthly Microsoft updates,
    or is that category now Enterprise-only?

I ask because the feed looks healthy from outside: Feed Status is green, the
sync runs daily, and thousands of existing VTs are modified every month. If
Windows patch detection is no longer Community content that is a fair product
decision, but it is not visible anywhere in the UI.

The feed comparison page lists
Cisco, Palo Alto and Fortinet as Enterprise content, which is clear — it does
not mention Windows patches either way.

2

I think the new local security checks are moved to new Feed-Version only.

What version are you running ?

3

Sure — here’s my setup:

greenbone-feed-sync 25.4.1
gvmd 26.33.1
openvas-scanner 23.49.4
gvm-libs 23.8.0
gsad 26.5.0

Syncing the defaults, which resolve to the 25.0 feed:

–nasl-url rsync://feed.community.greenbone.net/community/vulnerability-feed/25.0/vt-data/nasl/

–notus-url rsync://feed.community.greenbone.net/community/vulnerability-feed/25.0/vt-data/notus/

4

Hi Dora, this is intentional but not necessarily permanent in order to increase awareness of Enterprise offerings. Currently, continuing coverage for community is limited primarily to Notus and select Linux distributions.