Web application scanning, NVT's

Scanning / scan configuration
1

Hi,

I have enabled enable_web_application_scanning.

But when gvmd starts this error are logged:

md manage:WARNING:2026-07-31 06h49.46 utc:2375907: update_web_application_vts: No Web Application VTs db present, rebuilding Web Application VTs db from scratch
md manage: INFO:2026-07-31 06h49.46 utc:2375907: Initializing new web application VT database tables
md manage: INFO:2026-07-31 06h49.46 utc:2375900: manage_discovery_nvts: Updating Discovery NVTs
md manage: INFO:2026-07-31 06h49.46 utc:2375907: update_web_application_vts: Updating data from feed
md manage: INFO:2026-07-31 06h49.46 utc:2375907: update_zap_vts_from_feed: Updating ZAP VTs from feed
md manage:WARNING:2026-07-31 06h49.46 utc:2375907: update_zap_vts_from_feed: No ZAP VT metadata file found at /var/lib/greenbone/web-application-vts/zap-alerts.json
md manage: INFO:2026-07-31 06h49.46 utc:2375907: abort_web_application_vts_update: Updating Web Application VTs aborted
md manage: INFO:2026-07-31 06h49.47 utc:2375900: manage_discovery_nvts: Updating Discovery NVTs done
md manage: INFO:2026-07-31 06h49.49 utc:2375891: Assigning EPSS scores to VTs
md manage: INFO:2026-07-31 06h49.53 utc:2375891: update_zap_vt_severities_from_cves: updating ZAP VT severities from CVEs
md manage: INFO:2026-07-31 06h49.53 utc:2375891: update_zap_vt_group_severity_scores: updating ZAP VT severities for groups
How can receive the ZAP VT files?

Thanks

2

The vulnerability feed does not yet install this metadata. The feature itself is a new type of scanner type called Greenbone WAS (“Web Application Scanner”). The scanner is in the development and testing phase and I am not aware of the specific stage or expected release date.

As for the warning, it means gvmd cannot find zap-alerts.json[.gz]. For the testing phase, the public web-application-scanner/bin/generate-feed script generates:

  • The ZAP metadata index (alert-index.json )
  • Corresponding NASL VTs.

However, gvmd expects the index under the name zap-alerts.json, so there is a naming mismatch. If you are interested in participating in testing, the script can be modified maybe here, or else alert-index.json can be copied or linked to the expected filename.